diff --git a/.changes/2.1494.0.json b/.changes/2.1494.0.json new file mode 100644 index 0000000000..e5224b0797 --- /dev/null +++ b/.changes/2.1494.0.json @@ -0,0 +1,27 @@ +[ + { + "type": "feature", + "category": "CUR", + "description": "This release adds support for tagging and customers can now tag report definitions. Additionally, ReportStatus is now added to report definition to show when the last delivered time stamp and if it succeeded or not." + }, + { + "type": "feature", + "category": "ControlTower", + "description": "AWS Control Tower supports tagging for enabled controls. This release introduces TagResource, UntagResource and ListTagsForResource APIs to manage tags in existing enabled controls. It updates EnabledControl API to tag resources at creation time." + }, + { + "type": "feature", + "category": "EC2", + "description": "EC2 adds API updates to enable ENA Express at instance launch time." + }, + { + "type": "feature", + "category": "MarketplaceEntitlementService", + "description": "Add paginators to GetEntitlements." + }, + { + "type": "feature", + "category": "MediaConvert", + "description": "This release includes the ability to specify any input source as the primary input for corresponding follow modes, and allows users to specify fit and fill behaviors without resizing content." + } +] \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index fd70b6343d..97b197c041 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,14 @@ # Changelog for AWS SDK for JavaScript - + +## 2.1494.0 +* feature: CUR: This release adds support for tagging and customers can now tag report definitions. Additionally, ReportStatus is now added to report definition to show when the last delivered time stamp and if it succeeded or not. +* feature: ControlTower: AWS Control Tower supports tagging for enabled controls. This release introduces TagResource, UntagResource and ListTagsForResource APIs to manage tags in existing enabled controls. It updates EnabledControl API to tag resources at creation time. +* feature: EC2: EC2 adds API updates to enable ENA Express at instance launch time. +* feature: MarketplaceEntitlementService: Add paginators to GetEntitlements. +* feature: MediaConvert: This release includes the ability to specify any input source as the primary input for corresponding follow modes, and allows users to specify fit and fill behaviors without resizing content. + ## 2.1493.0 * feature: CloudFormation: Added new ConcurrencyMode feature for AWS CloudFormation StackSets for faster deployments to target accounts. * feature: CloudTrail: The Insights in Lake feature lets customers enable CloudTrail Insights on a source CloudTrail Lake event data store and create a destination event data store to collect Insights events based on unusual management event activity in the source event data store. diff --git a/README.md b/README.md index 86c9ab906e..0e7e79c4ed 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,7 @@ require('aws-sdk/lib/maintenance_mode_message').suppress = true; To use the SDK in the browser, simply add the following script tag to your HTML pages: - + You can also build a custom browser SDK with your specified set of AWS services. This can allow you to reduce the SDK's size, specify different API versions of diff --git a/apis/controltower-2018-05-10.min.json b/apis/controltower-2018-05-10.min.json index eb868d0ab1..267f497da7 100644 --- a/apis/controltower-2018-05-10.min.json +++ b/apis/controltower-2018-05-10.min.json @@ -51,6 +51,9 @@ ], "members": { "controlIdentifier": {}, + "tags": { + "shape": "S7" + }, "targetIdentifier": {} } }, @@ -60,6 +63,7 @@ "operationIdentifier" ], "members": { + "arn": {}, "operationIdentifier": {} } } @@ -88,11 +92,11 @@ "type": "structure", "members": { "endTime": { - "shape": "Sb" + "shape": "Sf" }, "operationType": {}, "startTime": { - "shape": "Sb" + "shape": "Sf" }, "status": {}, "statusMessage": {} @@ -127,10 +131,10 @@ "arn": {}, "controlIdentifier": {}, "driftStatusSummary": { - "shape": "Sj" + "shape": "Sm" }, "statusSummary": { - "shape": "Sl" + "shape": "So" }, "targetIdentifier": {}, "targetRegions": { @@ -179,10 +183,10 @@ "arn": {}, "controlIdentifier": {}, "driftStatusSummary": { - "shape": "Sj" + "shape": "Sm" }, "statusSummary": { - "shape": "Sl" + "shape": "So" }, "targetIdentifier": {} } @@ -191,20 +195,111 @@ "nextToken": {} } } + }, + "ListTagsForResource": { + "http": { + "method": "GET", + "requestUri": "/tags/{resourceArn}", + "responseCode": 200 + }, + "input": { + "type": "structure", + "required": [ + "resourceArn" + ], + "members": { + "resourceArn": { + "location": "uri", + "locationName": "resourceArn" + } + } + }, + "output": { + "type": "structure", + "required": [ + "tags" + ], + "members": { + "tags": { + "shape": "S7" + } + } + } + }, + "TagResource": { + "http": { + "requestUri": "/tags/{resourceArn}", + "responseCode": 204 + }, + "input": { + "type": "structure", + "required": [ + "resourceArn", + "tags" + ], + "members": { + "resourceArn": { + "location": "uri", + "locationName": "resourceArn" + }, + "tags": { + "shape": "S7" + } + } + }, + "output": { + "type": "structure", + "members": {} + } + }, + "UntagResource": { + "http": { + "method": "DELETE", + "requestUri": "/tags/{resourceArn}", + "responseCode": 204 + }, + "input": { + "type": "structure", + "required": [ + "resourceArn", + "tagKeys" + ], + "members": { + "resourceArn": { + "location": "uri", + "locationName": "resourceArn" + }, + "tagKeys": { + "location": "querystring", + "locationName": "tagKeys", + "type": "list", + "member": {} + } + } + }, + "output": { + "type": "structure", + "members": {} + } } }, "shapes": { - "Sb": { + "S7": { + "type": "map", + "key": {}, + "value": {} + }, + "Sf": { "type": "timestamp", "timestampFormat": "iso8601" }, - "Sj": { + "Sm": { "type": "structure", "members": { "driftStatus": {} } }, - "Sl": { + "So": { "type": "structure", "members": { "lastOperationIdentifier": {}, diff --git a/apis/controltower-2018-05-10.normal.json b/apis/controltower-2018-05-10.normal.json index 57d99e888c..7e84ed95f3 100644 --- a/apis/controltower-2018-05-10.normal.json +++ b/apis/controltower-2018-05-10.normal.json @@ -86,7 +86,7 @@ "shape": "ResourceNotFoundException" } ], - "documentation": "
This API call activates a control. It starts an asynchronous operation that creates AWS resources on the specified organizational unit and the accounts it contains. The resources created will vary according to the control that you specify. For usage examples, see the AWS Control Tower User Guide
" + "documentation": "This API call activates a control. It starts an asynchronous operation that creates AWS resources on the specified organizational unit and the accounts it contains. The resources created will vary according to the control that you specify. For usage examples, see the AWS Control Tower User Guide .
" }, "GetControlOperation": { "name": "GetControlOperation", @@ -118,7 +118,7 @@ "shape": "ResourceNotFoundException" } ], - "documentation": "Returns the status of a particular EnableControl
or DisableControl
operation. Displays a message in case of error. Details for an operation are available for 90 days. For usage examples, see the AWS Control Tower User Guide
Returns the status of a particular EnableControl
or DisableControl
operation. Displays a message in case of error. Details for an operation are available for 90 days. For usage examples, see the AWS Control Tower User Guide .
Provides details about the enabled control. For usage examples, see the AWS Control Tower User Guide .
Returned values
TargetRegions: Shows target AWS Regions where the enabled control is available to be deployed.
StatusSummary: Provides a detailed summary of the deployment status.
DriftSummary: Provides a detailed summary of the drifted status.
Retrieves details about an enabled control. For usage examples, see the AWS Control Tower User Guide .
" }, "ListEnabledControls": { "name": "ListEnabledControls", @@ -182,7 +182,85 @@ "shape": "ResourceNotFoundException" } ], - "documentation": "Lists the controls enabled by AWS Control Tower on the specified organizational unit and the accounts it contains. For usage examples, see the AWS Control Tower User Guide
" + "documentation": "Lists the controls enabled by AWS Control Tower on the specified organizational unit and the accounts it contains. For usage examples, see the AWS Control Tower User Guide .
" + }, + "ListTagsForResource": { + "name": "ListTagsForResource", + "http": { + "method": "GET", + "requestUri": "/tags/{resourceArn}", + "responseCode": 200 + }, + "input": { + "shape": "ListTagsForResourceInput" + }, + "output": { + "shape": "ListTagsForResourceOutput" + }, + "errors": [ + { + "shape": "ValidationException" + }, + { + "shape": "InternalServerException" + }, + { + "shape": "ResourceNotFoundException" + } + ], + "documentation": "Returns a list of tags associated with the resource. For usage examples, see the AWS Control Tower User Guide .
" + }, + "TagResource": { + "name": "TagResource", + "http": { + "method": "POST", + "requestUri": "/tags/{resourceArn}", + "responseCode": 204 + }, + "input": { + "shape": "TagResourceInput" + }, + "output": { + "shape": "TagResourceOutput" + }, + "errors": [ + { + "shape": "ValidationException" + }, + { + "shape": "InternalServerException" + }, + { + "shape": "ResourceNotFoundException" + } + ], + "documentation": "Applies tags to a resource. For usage examples, see the AWS Control Tower User Guide .
" + }, + "UntagResource": { + "name": "UntagResource", + "http": { + "method": "DELETE", + "requestUri": "/tags/{resourceArn}", + "responseCode": 204 + }, + "input": { + "shape": "UntagResourceInput" + }, + "output": { + "shape": "UntagResourceOutput" + }, + "errors": [ + { + "shape": "ValidationException" + }, + { + "shape": "InternalServerException" + }, + { + "shape": "ResourceNotFoundException" + } + ], + "documentation": "Removes tags from a resource. For usage examples, see the AWS Control Tower User Guide .
" } }, "shapes": { @@ -298,6 +376,10 @@ "shape": "ControlIdentifier", "documentation": "The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny control. For information on how to find the controlIdentifier
, see the overview page.
Tags to be applied to the EnabledControl
resource.
The ARN of the organizational unit. For information on how to find the targetIdentifier
, see the overview page.
The ARN of the EnabledControl
resource.
The ID of the asynchronous operation, which is used to track status. The operation is available for 90 days.
" @@ -321,56 +407,56 @@ "members": { "arn": { "shape": "Arn", - "documentation": "The ARN of the enabled control.
" + "documentation": "The ARN of the enabled control.
" }, "controlIdentifier": { "shape": "ControlIdentifier", - "documentation": " The control identifier of the enabled control. For information on how to find the controlIdentifier
, see the overview page.
The control identifier of the enabled control. For information on how to find the controlIdentifier
, see the overview page.
The drift status of the enabled control.
" + "documentation": "The drift status of the enabled control.
" }, "statusSummary": { "shape": "EnablementStatusSummary", - "documentation": "The deployment summary of the enabled control.
" + "documentation": "The deployment summary of the enabled control.
" }, "targetIdentifier": { "shape": "TargetIdentifier", - "documentation": " The ARN of the organizational unit. For information on how to find the targetIdentifier
, see the overview page.
The ARN of the organizational unit. For information on how to find the targetIdentifier
, see the overview page.
Target AWS Regions for the enabled control.
" + "documentation": "Target AWS Regions for the enabled control.
" } }, - "documentation": "Information about the enabled control.
" + "documentation": "Information about the enabled control.
" }, "EnabledControlSummary": { "type": "structure", "members": { "arn": { "shape": "Arn", - "documentation": "The ARN of the enabled control.
" + "documentation": "The ARN of the enabled control.
" }, "controlIdentifier": { "shape": "ControlIdentifier", - "documentation": "The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny control. For information on how to find the controlIdentifier
, see the overview page.
The controlIdentifier
of the enabled control.
The drift status of the enabled control.
" + "documentation": "The drift status of the enabled control.
" }, "statusSummary": { "shape": "EnablementStatusSummary", - "documentation": "A short description of the status of the enabled control.
" }, "targetIdentifier": { "shape": "TargetIdentifier", "documentation": "The ARN of the organizational unit.
" } }, - "documentation": "A summary of enabled controls.
" + "documentation": "Returns a summary of information about an enabled control.
" }, "EnabledControls": { "type": "list", @@ -391,14 +477,14 @@ "members": { "lastOperationIdentifier": { "shape": "OperationIdentifier", - "documentation": "The last operation identifier for the enabled control.
" + "documentation": "The last operation identifier for the enabled control.
" }, "status": { "shape": "EnablementStatus", "documentation": "The deployment status of the enabled control.
Valid values:
SUCCEEDED
: The enabledControl
configuration was deployed successfully.
UNDER_CHANGE
: The enabledControl
configuration is changing.
FAILED
: The enabledControl
configuration failed to deploy.
The deployment summary of the enabled control.
" + "documentation": "The deployment summary of the enabled control.
" }, "GetControlOperationInput": { "type": "structure", @@ -432,7 +518,7 @@ "members": { "enabledControlIdentifier": { "shape": "Arn", - "documentation": "The ARN of the enabled control.
" + "documentation": "The controlIdentifier
of the enabled control.
Information about the enabled control.
" + "documentation": "Information about the enabled control.
" } } }, @@ -484,6 +570,32 @@ } } }, + "ListTagsForResourceInput": { + "type": "structure", + "required": [ + "resourceArn" + ], + "members": { + "resourceArn": { + "shape": "Arn", + "documentation": "The ARN of the resource.
", + "location": "uri", + "locationName": "resourceArn" + } + } + }, + "ListTagsForResourceOutput": { + "type": "structure", + "required": [ + "tags" + ], + "members": { + "tags": { + "shape": "TagMap", + "documentation": "A list of tags, as key:value
strings.
The AWS Region name.
" + "documentation": "The AWS Region name.
" } }, "documentation": "An AWS Region in which AWS Control Tower expects to find the control deployed.
The expected Regions are based on the Regions that are governed by the landing zone. In certain cases, a control is not actually enabled in the Region as expected, such as during drift, or mixed governance.
" @@ -518,6 +630,58 @@ "type": "timestamp", "timestampFormat": "iso8601" }, + "TagKey": { + "type": "string", + "max": 128, + "min": 1 + }, + "TagKeys": { + "type": "list", + "member": { + "shape": "TagKey" + }, + "max": 200, + "min": 0 + }, + "TagMap": { + "type": "map", + "key": { + "shape": "TagKey" + }, + "value": { + "shape": "TagValue" + }, + "max": 200, + "min": 0 + }, + "TagResourceInput": { + "type": "structure", + "required": [ + "resourceArn", + "tags" + ], + "members": { + "resourceArn": { + "shape": "Arn", + "documentation": "The ARN of the resource to be tagged.
", + "location": "uri", + "locationName": "resourceArn" + }, + "tags": { + "shape": "TagMap", + "documentation": "Tags to be applied to the resource.
" + } + } + }, + "TagResourceOutput": { + "type": "structure", + "members": {} + }, + "TagValue": { + "type": "string", + "max": 256, + "min": 0 + }, "TargetIdentifier": { "type": "string", "max": 2048, @@ -529,7 +693,32 @@ "member": { "shape": "Region" } + }, + "UntagResourceInput": { + "type": "structure", + "required": [ + "resourceArn", + "tagKeys" + ], + "members": { + "resourceArn": { + "shape": "Arn", + "documentation": "The ARN of the resource.
", + "location": "uri", + "locationName": "resourceArn" + }, + "tagKeys": { + "shape": "TagKeys", + "documentation": "Tag keys to be removed from the resource.
", + "location": "querystring", + "locationName": "tagKeys" + } + } + }, + "UntagResourceOutput": { + "type": "structure", + "members": {} } }, - "documentation": "These interfaces allow you to apply the AWS library of pre-defined controls to your organizational units, programmatically. In AWS Control Tower, the terms \"control\" and \"guardrail\" are synonyms. .
To call these APIs, you'll need to know:
the controlIdentifier
for the control--or guardrail--you are targeting.
the ARN associated with the target organizational unit (OU), which we call the targetIdentifier
.
To get the controlIdentifier
for your AWS Control Tower control:
The controlIdentifier
is an ARN that is specified for each control. You can view the controlIdentifier
in the console on the Control details page, as well as in the documentation.
The controlIdentifier
is unique in each AWS Region for each control. You can find the controlIdentifier
for each Region and control in the Tables of control metadata in the AWS Control Tower User Guide.
A quick-reference list of control identifers for the AWS Control Tower legacy Strongly recommended and Elective controls is given in Resource identifiers for APIs and guardrails in the Controls reference guide section of the AWS Control Tower User Guide. Remember that Mandatory controls cannot be added or removed.
ARN format: arn:aws:controltower:{REGION}::control/{CONTROL_NAME}
Example:
arn:aws:controltower:us-west-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED
To get the targetIdentifier
:
The targetIdentifier
is the ARN for an OU.
In the AWS Organizations console, you can find the ARN for the OU on the Organizational unit details page associated with that OU.
OU ARN format:
arn:${Partition}:organizations::${MasterAccountId}:ou/o-${OrganizationId}/ou-${OrganizationalUnitId}
Details and examples
To view the open source resource repository on GitHub, see aws-cloudformation/aws-cloudformation-resource-providers-controltower
Recording API Requests
AWS Control Tower supports AWS CloudTrail, a service that records AWS API calls for your AWS account and delivers log files to an Amazon S3 bucket. By using information collected by CloudTrail, you can determine which requests the AWS Control Tower service received, who made the request and when, and so on. For more about AWS Control Tower and its support for CloudTrail, see Logging AWS Control Tower Actions with AWS CloudTrail in the AWS Control Tower User Guide. To learn more about CloudTrail, including how to turn it on and find your log files, see the AWS CloudTrail User Guide.
" + "documentation": "These interfaces allow you to apply the AWS library of pre-defined controls to your organizational units, programmatically. In AWS Control Tower, the terms \"control\" and \"guardrail\" are synonyms.
To call these APIs, you'll need to know:
the controlIdentifier
for the control--or guardrail--you are targeting.
the ARN associated with the target organizational unit (OU), which we call the targetIdentifier
.
the ARN associated with a resource that you wish to tag or untag.
To get the controlIdentifier
for your AWS Control Tower control:
The controlIdentifier
is an ARN that is specified for each control. You can view the controlIdentifier
in the console on the Control details page, as well as in the documentation.
The controlIdentifier
is unique in each AWS Region for each control. You can find the controlIdentifier
for each Region and control in the Tables of control metadata in the AWS Control Tower User Guide.
A quick-reference list of control identifers for the AWS Control Tower legacy Strongly recommended and Elective controls is given in Resource identifiers for APIs and controls in the Controls reference guide section of the AWS Control Tower User Guide. Remember that Mandatory controls cannot be added or removed.
ARN format: arn:aws:controltower:{REGION}::control/{CONTROL_NAME}
Example:
arn:aws:controltower:us-west-2::control/AWS-GR_AUTOSCALING_LAUNCH_CONFIG_PUBLIC_IP_DISABLED
To get the targetIdentifier
:
The targetIdentifier
is the ARN for an OU.
In the AWS Organizations console, you can find the ARN for the OU on the Organizational unit details page associated with that OU.
OU ARN format:
arn:${Partition}:organizations::${MasterAccountId}:ou/o-${OrganizationId}/ou-${OrganizationalUnitId}
Details and examples
To view the open source resource repository on GitHub, see aws-cloudformation/aws-cloudformation-resource-providers-controltower
Recording API Requests
AWS Control Tower supports AWS CloudTrail, a service that records AWS API calls for your AWS account and delivers log files to an Amazon S3 bucket. By using information collected by CloudTrail, you can determine which requests the AWS Control Tower service received, who made the request and when, and so on. For more about AWS Control Tower and its support for CloudTrail, see Logging AWS Control Tower Actions with AWS CloudTrail in the AWS Control Tower User Guide. To learn more about CloudTrail, including how to turn it on and find your log files, see the AWS CloudTrail User Guide.
" } \ No newline at end of file diff --git a/apis/cur-2017-01-06.min.json b/apis/cur-2017-01-06.min.json index 0d1b442038..6827ba73fe 100644 --- a/apis/cur-2017-01-06.min.json +++ b/apis/cur-2017-01-06.min.json @@ -16,6 +16,9 @@ "DeleteReportDefinition": { "input": { "type": "structure", + "required": [ + "ReportName" + ], "members": { "ReportName": {} } @@ -50,6 +53,25 @@ } } }, + "ListTagsForResource": { + "input": { + "type": "structure", + "required": [ + "ReportName" + ], + "members": { + "ReportName": {} + } + }, + "output": { + "type": "structure", + "members": { + "Tags": { + "shape": "St" + } + } + } + }, "ModifyReportDefinition": { "input": { "type": "structure", @@ -78,6 +100,48 @@ "members": { "ReportDefinition": { "shape": "Sa" + }, + "Tags": { + "shape": "St" + } + } + }, + "output": { + "type": "structure", + "members": {} + } + }, + "TagResource": { + "input": { + "type": "structure", + "required": [ + "ReportName", + "Tags" + ], + "members": { + "ReportName": {}, + "Tags": { + "shape": "St" + } + } + }, + "output": { + "type": "structure", + "members": {} + } + }, + "UntagResource": { + "input": { + "type": "structure", + "required": [ + "ReportName", + "TagKeys" + ], + "members": { + "ReportName": {}, + "TagKeys": { + "type": "list", + "member": {} } } }, @@ -120,7 +184,28 @@ "type": "boolean" }, "ReportVersioning": {}, - "BillingViewArn": {} + "BillingViewArn": {}, + "ReportStatus": { + "type": "structure", + "members": { + "lastDelivery": {}, + "lastStatus": {} + } + } + } + }, + "St": { + "type": "list", + "member": { + "type": "structure", + "required": [ + "Key", + "Value" + ], + "members": { + "Key": {}, + "Value": {} + } } } } diff --git a/apis/cur-2017-01-06.normal.json b/apis/cur-2017-01-06.normal.json index d711f984cb..87db766e91 100644 --- a/apis/cur-2017-01-06.normal.json +++ b/apis/cur-2017-01-06.normal.json @@ -33,7 +33,7 @@ "shape": "ValidationException" } ], - "documentation": "Deletes the specified report.
" + "documentation": "Deletes the specified report. Any tags associated with the report are also deleted.
" }, "DescribeReportDefinitions": { "name": "DescribeReportDefinitions", @@ -52,7 +52,32 @@ "shape": "InternalErrorException" } ], - "documentation": "Lists the AWS Cost and Usage reports available to this account.
" + "documentation": "Lists the Amazon Web Services Cost and Usage Report available to this account.
" + }, + "ListTagsForResource": { + "name": "ListTagsForResource", + "http": { + "method": "POST", + "requestUri": "/" + }, + "input": { + "shape": "ListTagsForResourceRequest" + }, + "output": { + "shape": "ListTagsForResourceResponse" + }, + "errors": [ + { + "shape": "ResourceNotFoundException" + }, + { + "shape": "InternalErrorException" + }, + { + "shape": "ValidationException" + } + ], + "documentation": "Lists the tags associated with the specified report definition.
" }, "ModifyReportDefinition": { "name": "ModifyReportDefinition", @@ -74,7 +99,7 @@ "shape": "ValidationException" } ], - "documentation": "Allows you to programatically update your report preferences.
" + "documentation": "Allows you to programmatically update your report preferences.
" }, "PutReportDefinition": { "name": "PutReportDefinition", @@ -100,15 +125,68 @@ }, { "shape": "ValidationException" + }, + { + "shape": "ResourceNotFoundException" } ], "documentation": "Creates a new report using the description that you provide.
" + }, + "TagResource": { + "name": "TagResource", + "http": { + "method": "POST", + "requestUri": "/" + }, + "input": { + "shape": "TagResourceRequest" + }, + "output": { + "shape": "TagResourceResponse" + }, + "errors": [ + { + "shape": "ResourceNotFoundException" + }, + { + "shape": "InternalErrorException" + }, + { + "shape": "ValidationException" + } + ], + "documentation": "Associates a set of tags with a report definition.
" + }, + "UntagResource": { + "name": "UntagResource", + "http": { + "method": "POST", + "requestUri": "/" + }, + "input": { + "shape": "UntagResourceRequest" + }, + "output": { + "shape": "UntagResourceResponse" + }, + "errors": [ + { + "shape": "ResourceNotFoundException" + }, + { + "shape": "InternalErrorException" + }, + { + "shape": "ValidationException" + } + ], + "documentation": "Disassociates a set of tags from a report definition.
" } }, "shapes": { "AWSRegion": { "type": "string", - "documentation": "The region of the S3 bucket that AWS delivers the report into.
", + "documentation": "The region of the S3 bucket that Amazon Web Services delivers the report into.
", "enum": [ "af-south-1", "ap-east-1", @@ -142,7 +220,7 @@ }, "AdditionalArtifact": { "type": "string", - "documentation": "The types of manifest that you want AWS to create for this report.
", + "documentation": "The types of manifest that you want Amazon Web Services to create for this report.
", "enum": [ "REDSHIFT", "QUICKSIGHT", @@ -163,7 +241,7 @@ }, "CompressionFormat": { "type": "string", - "documentation": "The compression format that AWS uses for the report.
", + "documentation": "The compression format that Amazon Web Services uses for the report.
", "enum": [ "ZIP", "GZIP", @@ -172,6 +250,9 @@ }, "DeleteReportDefinitionRequest": { "type": "structure", + "required": [ + "ReportName" + ], "members": { "ReportName": { "shape": "ReportName", @@ -203,14 +284,14 @@ "shape": "GenericString" } }, - "documentation": "Requests a list of AWS Cost and Usage reports owned by the account.
" + "documentation": "Requests a Amazon Web Services Cost and Usage Report list owned by the account.
" }, "DescribeReportDefinitionsResponse": { "type": "structure", "members": { "ReportDefinitions": { "shape": "ReportDefinitionList", - "documentation": "A list of AWS Cost and Usage reports owned by the account.
" + "documentation": "An Amazon Web Services Cost and Usage Report list owned by the account.
" }, "NextToken": { "shape": "GenericString" @@ -224,9 +305,44 @@ "max": 256, "pattern": "[A-Za-z0-9_\\.\\-=]*" }, + "LastDelivery": { + "type": "string", + "max": 20, + "min": 16, + "pattern": "[0-9]{8}[T][0-9]{6}([Z]|[+-][0-9]{4})" + }, + "LastStatus": { + "type": "string", + "enum": [ + "SUCCESS", + "ERROR_PERMISSIONS", + "ERROR_NO_BUCKET" + ] + }, + "ListTagsForResourceRequest": { + "type": "structure", + "required": [ + "ReportName" + ], + "members": { + "ReportName": { + "shape": "ReportName", + "documentation": "The report name of the report definition that tags are to be returned for.
" + } + } + }, + "ListTagsForResourceResponse": { + "type": "structure", + "members": { + "Tags": { + "shape": "TagList", + "documentation": "The tags assigned to the report definition resource.
" + } + } + }, "MaxResults": { "type": "integer", - "documentation": "The maximum number of results that AWS returns for the operation.
", + "documentation": "The maximum number of results that Amazon Web Services returns for the operation.
", "box": true, "max": 5, "min": 5 @@ -259,6 +375,10 @@ "ReportDefinition": { "shape": "ReportDefinition", "documentation": "Represents the output of the PutReportDefinition operation. The content consists of the detailed metadata and data file information.
" + }, + "Tags": { + "shape": "TagList", + "documentation": "The tags to be assigned to the report definition resource.
" } }, "documentation": "Creates a Cost and Usage Report.
" @@ -324,10 +444,14 @@ }, "BillingViewArn": { "shape": "BillingViewArn", - "documentation": "The Amazon resource name of the billing view. You can get this value by using the billing view service public APIs.
" + "documentation": " The Amazon resource name of the billing view. The BillingViewArn
is needed to create Amazon Web Services Cost and Usage Report for each billing group maintained in the Amazon Web Services Billing Conductor service. The BillingViewArn
for a billing group can be constructed as: arn:aws:billing::payer-account-id:billingview/billing-group-primary-account-id
The status of the report.
" } }, - "documentation": "The definition of AWS Cost and Usage Report. You can specify the report name, time unit, report format, compression format, S3 bucket, additional artifacts, and schema elements in the definition.
" + "documentation": "The definition of Amazon Web Services Cost and Usage Report. You can specify the report name, time unit, report format, compression format, S3 bucket, additional artifacts, and schema elements in the definition.
" }, "ReportDefinitionList": { "type": "list", @@ -338,7 +462,7 @@ }, "ReportFormat": { "type": "string", - "documentation": "The format that AWS saves the report in.
", + "documentation": "The format that Amazon Web Services saves the report in.
", "enum": [ "textORcsv", "Parquet" @@ -350,6 +474,20 @@ "max": 256, "pattern": "[0-9A-Za-z!\\-_.*\\'()]+" }, + "ReportStatus": { + "type": "structure", + "members": { + "lastDelivery": { + "shape": "LastDelivery", + "documentation": "A timestamp that gives the date of a report delivery.
" + }, + "lastStatus": { + "shape": "LastStatus", + "documentation": "An enum that gives the status of a report delivery.
" + } + }, + "documentation": "A two element dictionary with a lastDelivery
and lastStatus
key whose values describe the date and status of the last delivered report for a particular report definition.
The S3 bucket where AWS delivers the report.
", + "documentation": "The S3 bucket where Amazon Web Services delivers the report.
", "max": 256, "pattern": "[A-Za-z0-9_\\.\\-]+" }, "S3Prefix": { "type": "string", - "documentation": "The prefix that AWS adds to the report name when AWS delivers the report. Your prefix can't include spaces.
", + "documentation": "The prefix that Amazon Web Services adds to the report name when Amazon Web Services delivers the report. Your prefix can't include spaces.
", "max": 256, "pattern": "[0-9A-Za-z!\\-_.*\\'()/]*" }, "SchemaElement": { "type": "string", - "documentation": "Whether or not AWS includes resource IDs in the report.
", + "documentation": "Whether or not Amazon Web Services includes resource IDs in the report.
", "enum": [ "RESOURCES", - "SPLIT_COST_ALLOCATION_DATA" + "SPLIT_COST_ALLOCATION_DATA", + "MANUAL_DISCOUNT_COMPATIBILITY" ] }, "SchemaElementList": { @@ -384,6 +523,73 @@ }, "documentation": "A list of strings that indicate the content that is included in the report, such as service or usage type.
" }, + "Tag": { + "type": "structure", + "required": [ + "Key", + "Value" + ], + "members": { + "Key": { + "shape": "TagKey", + "documentation": "The key of the tag. Tag keys are case sensitive. Each report definition can only have up to one tag with the same key. If you try to add an existing tag with the same key, the existing tag value will be updated to the new value.
" + }, + "Value": { + "shape": "TagValue", + "documentation": "The value of the tag. Tag values are case-sensitive. This can be an empty string.
" + } + }, + "documentation": "Describes a tag. A tag is a key-value pair. You can add up to 50 tags to a report definition.
" + }, + "TagKey": { + "type": "string", + "max": 128, + "min": 1, + "pattern": ".*" + }, + "TagKeyList": { + "type": "list", + "member": { + "shape": "TagKey" + }, + "max": 200, + "min": 0 + }, + "TagList": { + "type": "list", + "member": { + "shape": "Tag" + }, + "max": 200, + "min": 0 + }, + "TagResourceRequest": { + "type": "structure", + "required": [ + "ReportName", + "Tags" + ], + "members": { + "ReportName": { + "shape": "ReportName", + "documentation": "The report name of the report definition that tags are to be associated with.
" + }, + "Tags": { + "shape": "TagList", + "documentation": "The tags to be assigned to the report definition resource.
" + } + } + }, + "TagResourceResponse": { + "type": "structure", + "members": {} + }, + "TagValue": { + "type": "string", + "max": 256, + "min": 0, + "pattern": ".*" + }, "TimeUnit": { "type": "string", "documentation": "The length of time covered by the report.
", @@ -392,7 +598,28 @@ "DAILY", "MONTHLY" ] + }, + "UntagResourceRequest": { + "type": "structure", + "required": [ + "ReportName", + "TagKeys" + ], + "members": { + "ReportName": { + "shape": "ReportName", + "documentation": "The report name of the report definition that tags are to be disassociated from.
" + }, + "TagKeys": { + "shape": "TagKeyList", + "documentation": "The tags to be disassociated from the report definition resource.
" + } + } + }, + "UntagResourceResponse": { + "type": "structure", + "members": {} } }, - "documentation": "The AWS Cost and Usage Report API enables you to programmatically create, query, and delete AWS Cost and Usage report definitions.
AWS Cost and Usage reports track the monthly AWS costs and usage associated with your AWS account. The report contains line items for each unique combination of AWS product, usage type, and operation that your AWS account uses. You can configure the AWS Cost and Usage report to show only the data that you want, using the AWS Cost and Usage API.
Service Endpoint
The AWS Cost and Usage Report API provides the following endpoint:
cur.us-east-1.amazonaws.com
You can use the Amazon Web Services Cost and Usage Report API to programmatically create, query, and delete Amazon Web Services Cost and Usage Report definitions.
Amazon Web Services Cost and Usage Report track the monthly Amazon Web Services costs and usage associated with your Amazon Web Services account. The report contains line items for each unique combination of Amazon Web Services product, usage type, and operation that your Amazon Web Services account uses. You can configure the Amazon Web Services Cost and Usage Report to show only the data that you want, using the Amazon Web Services Cost and Usage Report API.
Service Endpoint
The Amazon Web Services Cost and Usage Report API provides the following endpoint:
cur.us-east-1.amazonaws.com
Indicates whether ENA Express is enabled for the network interface that's attached to the instance.
", + "documentation": "Indicates whether ENA Express is enabled for the network interface.
", "locationName": "enaSrdEnabled" }, "EnaSrdUdpSpecification": { "shape": "AttachmentEnaSrdUdpSpecification", - "documentation": "ENA Express configuration for UDP network traffic.
", + "documentation": "Configures ENA Express for UDP network traffic.
", "locationName": "enaSrdUdpSpecification" } }, - "documentation": "Describes the ENA Express configuration for the network interface that's attached to the instance.
" + "documentation": "ENA Express uses Amazon Web Services Scalable Reliable Datagram (SRD) technology to increase the maximum bandwidth used per stream and minimize tail latency of network traffic between EC2 instances. With ENA Express, you can communicate between two EC2 instances in the same subnet within the same account, or in different accounts. Both sending and receiving instances must have ENA Express enabled.
To improve the reliability of network packet delivery, ENA Express reorders network packets on the receiving end by default. However, some UDP-based applications are designed to handle network packets that are out of order to reduce the overhead for packet delivery at the network layer. When ENA Express is enabled, you can specify whether UDP network traffic uses it.
" }, "AttachmentEnaSrdUdpSpecification": { "type": "structure", @@ -10988,7 +10988,7 @@ "locationName": "enaSrdUdpEnabled" } }, - "documentation": "Describes the ENA Express configuration for UDP traffic on the network interface that's attached to the instance.
" + "documentation": "ENA Express is compatible with both TCP and UDP transport protocols. When it's enabled, TCP traffic automatically uses it. However, some UDP-based applications are designed to handle network packets that are out of order, without a need for retransmission, such as live video broadcasting or other near-real-time applications. For UDP traffic, you can specify whether to use ENA Express, based on your application environment needs.
" }, "AttachmentStatus": { "type": "string", @@ -23302,7 +23302,7 @@ "members": { "Filters": { "shape": "FilterList", - "documentation": "The filters.
affinity
- The affinity setting for an instance running on a Dedicated Host (default
| host
).
architecture
- The instance architecture (i386
| x86_64
| arm64
).
availability-zone
- The Availability Zone of the instance.
block-device-mapping.attach-time
- The attach time for an EBS volume mapped to the instance, for example, 2022-09-15T17:15:20.000Z
.
block-device-mapping.delete-on-termination
- A Boolean that indicates whether the EBS volume is deleted on instance termination.
block-device-mapping.device-name
- The device name specified in the block device mapping (for example, /dev/sdh
or xvdh
).
block-device-mapping.status
- The status for the EBS volume (attaching
| attached
| detaching
| detached
).
block-device-mapping.volume-id
- The volume ID of the EBS volume.
boot-mode
- The boot mode that was specified by the AMI (legacy-bios
| uefi
| uefi-preferred
).
capacity-reservation-id
- The ID of the Capacity Reservation into which the instance was launched.
capacity-reservation-specification.capacity-reservation-preference
- The instance's Capacity Reservation preference (open
| none
).
capacity-reservation-specification.capacity-reservation-target.capacity-reservation-id
- The ID of the targeted Capacity Reservation.
capacity-reservation-specification.capacity-reservation-target.capacity-reservation-resource-group-arn
- The ARN of the targeted Capacity Reservation group.
client-token
- The idempotency token you provided when you launched the instance.
current-instance-boot-mode
- The boot mode that is used to launch the instance at launch or start (legacy-bios
| uefi
).
dns-name
- The public DNS name of the instance.
ebs-optimized
- A Boolean that indicates whether the instance is optimized for Amazon EBS I/O.
ena-support
- A Boolean that indicates whether the instance is enabled for enhanced networking with ENA.
enclave-options.enabled
- A Boolean that indicates whether the instance is enabled for Amazon Web Services Nitro Enclaves.
hibernation-options.configured
- A Boolean that indicates whether the instance is enabled for hibernation. A value of true
means that the instance is enabled for hibernation.
host-id
- The ID of the Dedicated Host on which the instance is running, if applicable.
hypervisor
- The hypervisor type of the instance (ovm
| xen
). The value xen
is used for both Xen and Nitro hypervisors.
iam-instance-profile.arn
- The instance profile associated with the instance. Specified as an ARN.
iam-instance-profile.id
- The instance profile associated with the instance. Specified as an ID.
iam-instance-profile.name
- The instance profile associated with the instance. Specified as an name.
image-id
- The ID of the image used to launch the instance.
instance-id
- The ID of the instance.
instance-lifecycle
- Indicates whether this is a Spot Instance or a Scheduled Instance (spot
| scheduled
).
instance-state-code
- The state of the instance, as a 16-bit unsigned integer. The high byte is used for internal purposes and should be ignored. The low byte is set based on the state represented. The valid values are: 0 (pending), 16 (running), 32 (shutting-down), 48 (terminated), 64 (stopping), and 80 (stopped).
instance-state-name
- The state of the instance (pending
| running
| shutting-down
| terminated
| stopping
| stopped
).
instance-type
- The type of instance (for example, t2.micro
).
instance.group-id
- The ID of the security group for the instance.
instance.group-name
- The name of the security group for the instance.
ip-address
- The public IPv4 address of the instance.
ipv6-address
- The IPv6 address of the instance.
kernel-id
- The kernel ID.
key-name
- The name of the key pair used when the instance was launched.
launch-index
- When launching multiple instances, this is the index for the instance in the launch group (for example, 0, 1, 2, and so on).
launch-time
- The time when the instance was launched, in the ISO 8601 format in the UTC time zone (YYYY-MM-DDThh:mm:ss.sssZ), for example, 2021-09-29T11:04:43.305Z
. You can use a wildcard (*
), for example, 2021-09-29T*
, which matches an entire day.
maintenance-options.auto-recovery
- The current automatic recovery behavior of the instance (disabled
| default
).
metadata-options.http-endpoint
- The status of access to the HTTP metadata endpoint on your instance (enabled
| disabled
)
metadata-options.http-protocol-ipv4
- Indicates whether the IPv4 endpoint is enabled (disabled
| enabled
).
metadata-options.http-protocol-ipv6
- Indicates whether the IPv6 endpoint is enabled (disabled
| enabled
).
metadata-options.http-put-response-hop-limit
- The HTTP metadata request put response hop limit (integer, possible values 1
to 64
)
metadata-options.http-tokens
- The metadata request authorization state (optional
| required
)
metadata-options.instance-metadata-tags
- The status of access to instance tags from the instance metadata (enabled
| disabled
)
metadata-options.state
- The state of the metadata option changes (pending
| applied
).
monitoring-state
- Indicates whether detailed monitoring is enabled (disabled
| enabled
).
network-interface.addresses.association.allocation-id
- The allocation ID.
network-interface.addresses.association.association-id
- The association ID.
network-interface.addresses.association.carrier-ip
- The carrier IP address.
network-interface.addresses.association.customer-owned-ip
- The customer-owned IP address.
network-interface.addresses.association.ip-owner-id
- The owner ID of the private IPv4 address associated with the network interface.
network-interface.addresses.association.public-dns-name
- The public DNS name.
network-interface.addresses.association.public-ip
- The ID of the association of an Elastic IP address (IPv4) with a network interface.
network-interface.addresses.primary
- Specifies whether the IPv4 address of the network interface is the primary private IPv4 address.
network-interface.addresses.private-dns-name
- The private DNS name.
network-interface.addresses.private-ip-address
- The private IPv4 address associated with the network interface.
network-interface.association.allocation-id
- The allocation ID returned when you allocated the Elastic IP address (IPv4) for your network interface.
network-interface.association.association-id
- The association ID returned when the network interface was associated with an IPv4 address.
network-interface.association.carrier-ip
- The customer-owned IP address.
network-interface.association.customer-owned-ip
- The customer-owned IP address.
network-interface.association.ip-owner-id
- The owner of the Elastic IP address (IPv4) associated with the network interface.
network-interface.association.public-dns-name
- The public DNS name.
network-interface.association.public-ip
- The address of the Elastic IP address (IPv4) bound to the network interface.
network-interface.attachment.attach-time
- The time that the network interface was attached to an instance.
network-interface.attachment.attachment-id
- The ID of the interface attachment.
network-interface.attachment.delete-on-termination
- Specifies whether the attachment is deleted when an instance is terminated.
network-interface.attachment.device-index
- The device index to which the network interface is attached.
network-interface.attachment.instance-id
- The ID of the instance to which the network interface is attached.
network-interface.attachment.instance-owner-id
- The owner ID of the instance to which the network interface is attached.
network-interface.attachment.network-card-index
- The index of the network card.
network-interface.attachment.status
- The status of the attachment (attaching
| attached
| detaching
| detached
).
network-interface.availability-zone
- The Availability Zone for the network interface.
network-interface.deny-all-igw-traffic
- A Boolean that indicates whether a network interface with an IPv6 address is unreachable from the public internet.
network-interface.description
- The description of the network interface.
network-interface.group-id
- The ID of a security group associated with the network interface.
network-interface.group-name
- The name of a security group associated with the network interface.
network-interface.ipv4-prefixes.ipv4-prefix
- The IPv4 prefixes that are assigned to the network interface.
network-interface.ipv6-address
- The IPv6 address associated with the network interface.
network-interface.ipv6-addresses.ipv6-address
- The IPv6 address associated with the network interface.
network-interface.ipv6-addresses.is-primary-ipv6
- A Boolean that indicates whether this is the primary IPv6 address.
network-interface.ipv6-native
- A Boolean that indicates whether this is an IPv6 only network interface.
network-interface.ipv6-prefixes.ipv6-prefix
- The IPv6 prefix assigned to the network interface.
network-interface.mac-address
- The MAC address of the network interface.
network-interface.network-interface-id
- The ID of the network interface.
network-interface.outpost-arn
- The ARN of the Outpost.
network-interface.owner-id
- The ID of the owner of the network interface.
network-interface.private-dns-name
- The private DNS name of the network interface.
network-interface.private-ip-address
- The private IPv4 address.
network-interface.public-dns-name
- The public DNS name.
network-interface.requester-id
- The requester ID for the network interface.
network-interface.requester-managed
- Indicates whether the network interface is being managed by Amazon Web Services.
network-interface.status
- The status of the network interface (available
) | in-use
).
network-interface.source-dest-check
- Whether the network interface performs source/destination checking. A value of true
means that checking is enabled, and false
means that checking is disabled. The value must be false
for the network interface to perform network address translation (NAT) in your VPC.
network-interface.subnet-id
- The ID of the subnet for the network interface.
network-interface.tag-key
- The key of a tag assigned to the network interface.
network-interface.tag-value
- The value of a tag assigned to the network interface.
network-interface.vpc-id
- The ID of the VPC for the network interface.
outpost-arn
- The Amazon Resource Name (ARN) of the Outpost.
owner-id
- The Amazon Web Services account ID of the instance owner.
placement-group-name
- The name of the placement group for the instance.
placement-partition-number
- The partition in which the instance is located.
platform
- The platform. To list only Windows instances, use windows
.
platform-details
- The platform (Linux/UNIX
| Red Hat BYOL Linux
| Red Hat Enterprise Linux
| Red Hat Enterprise Linux with HA
| Red Hat Enterprise Linux with SQL Server Standard and HA
| Red Hat Enterprise Linux with SQL Server Enterprise and HA
| Red Hat Enterprise Linux with SQL Server Standard
| Red Hat Enterprise Linux with SQL Server Web
| Red Hat Enterprise Linux with SQL Server Enterprise
| SQL Server Enterprise
| SQL Server Standard
| SQL Server Web
| SUSE Linux
| Ubuntu Pro
| Windows
| Windows BYOL
| Windows with SQL Server Enterprise
| Windows with SQL Server Standard
| Windows with SQL Server Web
).
private-dns-name
- The private IPv4 DNS name of the instance.
private-dns-name-options.enable-resource-name-dns-a-record
- A Boolean that indicates whether to respond to DNS queries for instance hostnames with DNS A records.
private-dns-name-options.enable-resource-name-dns-aaaa-record
- A Boolean that indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
private-dns-name-options.hostname-type
- The type of hostname (ip-name
| resource-name
).
private-ip-address
- The private IPv4 address of the instance.
product-code
- The product code associated with the AMI used to launch the instance.
product-code.type
- The type of product code (devpay
| marketplace
).
ramdisk-id
- The RAM disk ID.
reason
- The reason for the current state of the instance (for example, shows \"User Initiated [date]\" when you stop or terminate the instance). Similar to the state-reason-code filter.
requester-id
- The ID of the entity that launched the instance on your behalf (for example, Amazon Web Services Management Console, Auto Scaling, and so on).
reservation-id
- The ID of the instance's reservation. A reservation ID is created any time you launch an instance. A reservation ID has a one-to-one relationship with an instance launch request, but can be associated with more than one instance if you launch multiple instances using the same launch request. For example, if you launch one instance, you get one reservation ID. If you launch ten instances using the same launch request, you also get one reservation ID.
root-device-name
- The device name of the root device volume (for example, /dev/sda1
).
root-device-type
- The type of the root device volume (ebs
| instance-store
).
source-dest-check
- Indicates whether the instance performs source/destination checking. A value of true
means that checking is enabled, and false
means that checking is disabled. The value must be false
for the instance to perform network address translation (NAT) in your VPC.
spot-instance-request-id
- The ID of the Spot Instance request.
state-reason-code
- The reason code for the state change.
state-reason-message
- A message that describes the state change.
subnet-id
- The ID of the subnet for the instance.
tag:<key>
- The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner
and the value TeamA
, specify tag:Owner
for the filter name and TeamA
for the filter value.
tag-key
- The key of a tag assigned to the resource. Use this filter to find all resources that have a tag with a specific key, regardless of the tag value.
tenancy
- The tenancy of an instance (dedicated
| default
| host
).
tpm-support
- Indicates if the instance is configured for NitroTPM support (v2.0
).
usage-operation
- The usage operation value for the instance (RunInstances
| RunInstances:00g0
| RunInstances:0010
| RunInstances:1010
| RunInstances:1014
| RunInstances:1110
| RunInstances:0014
| RunInstances:0210
| RunInstances:0110
| RunInstances:0100
| RunInstances:0004
| RunInstances:0200
| RunInstances:000g
| RunInstances:0g00
| RunInstances:0002
| RunInstances:0800
| RunInstances:0102
| RunInstances:0006
| RunInstances:0202
).
usage-operation-update-time
- The time that the usage operation was last updated, for example, 2022-09-15T17:15:20.000Z
.
virtualization-type
- The virtualization type of the instance (paravirtual
| hvm
).
vpc-id
- The ID of the VPC that the instance is running in.
The filters.
affinity
- The affinity setting for an instance running on a Dedicated Host (default
| host
).
architecture
- The instance architecture (i386
| x86_64
| arm64
).
availability-zone
- The Availability Zone of the instance.
block-device-mapping.attach-time
- The attach time for an EBS volume mapped to the instance, for example, 2022-09-15T17:15:20.000Z
.
block-device-mapping.delete-on-termination
- A Boolean that indicates whether the EBS volume is deleted on instance termination.
block-device-mapping.device-name
- The device name specified in the block device mapping (for example, /dev/sdh
or xvdh
).
block-device-mapping.status
- The status for the EBS volume (attaching
| attached
| detaching
| detached
).
block-device-mapping.volume-id
- The volume ID of the EBS volume.
boot-mode
- The boot mode that was specified by the AMI (legacy-bios
| uefi
| uefi-preferred
).
capacity-reservation-id
- The ID of the Capacity Reservation into which the instance was launched.
capacity-reservation-specification.capacity-reservation-preference
- The instance's Capacity Reservation preference (open
| none
).
capacity-reservation-specification.capacity-reservation-target.capacity-reservation-id
- The ID of the targeted Capacity Reservation.
capacity-reservation-specification.capacity-reservation-target.capacity-reservation-resource-group-arn
- The ARN of the targeted Capacity Reservation group.
client-token
- The idempotency token you provided when you launched the instance.
current-instance-boot-mode
- The boot mode that is used to launch the instance at launch or start (legacy-bios
| uefi
).
dns-name
- The public DNS name of the instance.
ebs-optimized
- A Boolean that indicates whether the instance is optimized for Amazon EBS I/O.
ena-support
- A Boolean that indicates whether the instance is enabled for enhanced networking with ENA.
enclave-options.enabled
- A Boolean that indicates whether the instance is enabled for Amazon Web Services Nitro Enclaves.
hibernation-options.configured
- A Boolean that indicates whether the instance is enabled for hibernation. A value of true
means that the instance is enabled for hibernation.
host-id
- The ID of the Dedicated Host on which the instance is running, if applicable.
hypervisor
- The hypervisor type of the instance (ovm
| xen
). The value xen
is used for both Xen and Nitro hypervisors.
iam-instance-profile.arn
- The instance profile associated with the instance. Specified as an ARN.
iam-instance-profile.id
- The instance profile associated with the instance. Specified as an ID.
iam-instance-profile.name
- The instance profile associated with the instance. Specified as an name.
image-id
- The ID of the image used to launch the instance.
instance-id
- The ID of the instance.
instance-lifecycle
- Indicates whether this is a Spot Instance, a Scheduled Instance, or a Capacity Block (spot
| scheduled
| capacity-block
).
instance-state-code
- The state of the instance, as a 16-bit unsigned integer. The high byte is used for internal purposes and should be ignored. The low byte is set based on the state represented. The valid values are: 0 (pending), 16 (running), 32 (shutting-down), 48 (terminated), 64 (stopping), and 80 (stopped).
instance-state-name
- The state of the instance (pending
| running
| shutting-down
| terminated
| stopping
| stopped
).
instance-type
- The type of instance (for example, t2.micro
).
instance.group-id
- The ID of the security group for the instance.
instance.group-name
- The name of the security group for the instance.
ip-address
- The public IPv4 address of the instance.
ipv6-address
- The IPv6 address of the instance.
kernel-id
- The kernel ID.
key-name
- The name of the key pair used when the instance was launched.
launch-index
- When launching multiple instances, this is the index for the instance in the launch group (for example, 0, 1, 2, and so on).
launch-time
- The time when the instance was launched, in the ISO 8601 format in the UTC time zone (YYYY-MM-DDThh:mm:ss.sssZ), for example, 2021-09-29T11:04:43.305Z
. You can use a wildcard (*
), for example, 2021-09-29T*
, which matches an entire day.
maintenance-options.auto-recovery
- The current automatic recovery behavior of the instance (disabled
| default
).
metadata-options.http-endpoint
- The status of access to the HTTP metadata endpoint on your instance (enabled
| disabled
)
metadata-options.http-protocol-ipv4
- Indicates whether the IPv4 endpoint is enabled (disabled
| enabled
).
metadata-options.http-protocol-ipv6
- Indicates whether the IPv6 endpoint is enabled (disabled
| enabled
).
metadata-options.http-put-response-hop-limit
- The HTTP metadata request put response hop limit (integer, possible values 1
to 64
)
metadata-options.http-tokens
- The metadata request authorization state (optional
| required
)
metadata-options.instance-metadata-tags
- The status of access to instance tags from the instance metadata (enabled
| disabled
)
metadata-options.state
- The state of the metadata option changes (pending
| applied
).
monitoring-state
- Indicates whether detailed monitoring is enabled (disabled
| enabled
).
network-interface.addresses.association.allocation-id
- The allocation ID.
network-interface.addresses.association.association-id
- The association ID.
network-interface.addresses.association.carrier-ip
- The carrier IP address.
network-interface.addresses.association.customer-owned-ip
- The customer-owned IP address.
network-interface.addresses.association.ip-owner-id
- The owner ID of the private IPv4 address associated with the network interface.
network-interface.addresses.association.public-dns-name
- The public DNS name.
network-interface.addresses.association.public-ip
- The ID of the association of an Elastic IP address (IPv4) with a network interface.
network-interface.addresses.primary
- Specifies whether the IPv4 address of the network interface is the primary private IPv4 address.
network-interface.addresses.private-dns-name
- The private DNS name.
network-interface.addresses.private-ip-address
- The private IPv4 address associated with the network interface.
network-interface.association.allocation-id
- The allocation ID returned when you allocated the Elastic IP address (IPv4) for your network interface.
network-interface.association.association-id
- The association ID returned when the network interface was associated with an IPv4 address.
network-interface.association.carrier-ip
- The customer-owned IP address.
network-interface.association.customer-owned-ip
- The customer-owned IP address.
network-interface.association.ip-owner-id
- The owner of the Elastic IP address (IPv4) associated with the network interface.
network-interface.association.public-dns-name
- The public DNS name.
network-interface.association.public-ip
- The address of the Elastic IP address (IPv4) bound to the network interface.
network-interface.attachment.attach-time
- The time that the network interface was attached to an instance.
network-interface.attachment.attachment-id
- The ID of the interface attachment.
network-interface.attachment.delete-on-termination
- Specifies whether the attachment is deleted when an instance is terminated.
network-interface.attachment.device-index
- The device index to which the network interface is attached.
network-interface.attachment.instance-id
- The ID of the instance to which the network interface is attached.
network-interface.attachment.instance-owner-id
- The owner ID of the instance to which the network interface is attached.
network-interface.attachment.network-card-index
- The index of the network card.
network-interface.attachment.status
- The status of the attachment (attaching
| attached
| detaching
| detached
).
network-interface.availability-zone
- The Availability Zone for the network interface.
network-interface.deny-all-igw-traffic
- A Boolean that indicates whether a network interface with an IPv6 address is unreachable from the public internet.
network-interface.description
- The description of the network interface.
network-interface.group-id
- The ID of a security group associated with the network interface.
network-interface.group-name
- The name of a security group associated with the network interface.
network-interface.ipv4-prefixes.ipv4-prefix
- The IPv4 prefixes that are assigned to the network interface.
network-interface.ipv6-address
- The IPv6 address associated with the network interface.
network-interface.ipv6-addresses.ipv6-address
- The IPv6 address associated with the network interface.
network-interface.ipv6-addresses.is-primary-ipv6
- A Boolean that indicates whether this is the primary IPv6 address.
network-interface.ipv6-native
- A Boolean that indicates whether this is an IPv6 only network interface.
network-interface.ipv6-prefixes.ipv6-prefix
- The IPv6 prefix assigned to the network interface.
network-interface.mac-address
- The MAC address of the network interface.
network-interface.network-interface-id
- The ID of the network interface.
network-interface.outpost-arn
- The ARN of the Outpost.
network-interface.owner-id
- The ID of the owner of the network interface.
network-interface.private-dns-name
- The private DNS name of the network interface.
network-interface.private-ip-address
- The private IPv4 address.
network-interface.public-dns-name
- The public DNS name.
network-interface.requester-id
- The requester ID for the network interface.
network-interface.requester-managed
- Indicates whether the network interface is being managed by Amazon Web Services.
network-interface.status
- The status of the network interface (available
) | in-use
).
network-interface.source-dest-check
- Whether the network interface performs source/destination checking. A value of true
means that checking is enabled, and false
means that checking is disabled. The value must be false
for the network interface to perform network address translation (NAT) in your VPC.
network-interface.subnet-id
- The ID of the subnet for the network interface.
network-interface.tag-key
- The key of a tag assigned to the network interface.
network-interface.tag-value
- The value of a tag assigned to the network interface.
network-interface.vpc-id
- The ID of the VPC for the network interface.
outpost-arn
- The Amazon Resource Name (ARN) of the Outpost.
owner-id
- The Amazon Web Services account ID of the instance owner.
placement-group-name
- The name of the placement group for the instance.
placement-partition-number
- The partition in which the instance is located.
platform
- The platform. To list only Windows instances, use windows
.
platform-details
- The platform (Linux/UNIX
| Red Hat BYOL Linux
| Red Hat Enterprise Linux
| Red Hat Enterprise Linux with HA
| Red Hat Enterprise Linux with SQL Server Standard and HA
| Red Hat Enterprise Linux with SQL Server Enterprise and HA
| Red Hat Enterprise Linux with SQL Server Standard
| Red Hat Enterprise Linux with SQL Server Web
| Red Hat Enterprise Linux with SQL Server Enterprise
| SQL Server Enterprise
| SQL Server Standard
| SQL Server Web
| SUSE Linux
| Ubuntu Pro
| Windows
| Windows BYOL
| Windows with SQL Server Enterprise
| Windows with SQL Server Standard
| Windows with SQL Server Web
).
private-dns-name
- The private IPv4 DNS name of the instance.
private-dns-name-options.enable-resource-name-dns-a-record
- A Boolean that indicates whether to respond to DNS queries for instance hostnames with DNS A records.
private-dns-name-options.enable-resource-name-dns-aaaa-record
- A Boolean that indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
private-dns-name-options.hostname-type
- The type of hostname (ip-name
| resource-name
).
private-ip-address
- The private IPv4 address of the instance.
product-code
- The product code associated with the AMI used to launch the instance.
product-code.type
- The type of product code (devpay
| marketplace
).
ramdisk-id
- The RAM disk ID.
reason
- The reason for the current state of the instance (for example, shows \"User Initiated [date]\" when you stop or terminate the instance). Similar to the state-reason-code filter.
requester-id
- The ID of the entity that launched the instance on your behalf (for example, Amazon Web Services Management Console, Auto Scaling, and so on).
reservation-id
- The ID of the instance's reservation. A reservation ID is created any time you launch an instance. A reservation ID has a one-to-one relationship with an instance launch request, but can be associated with more than one instance if you launch multiple instances using the same launch request. For example, if you launch one instance, you get one reservation ID. If you launch ten instances using the same launch request, you also get one reservation ID.
root-device-name
- The device name of the root device volume (for example, /dev/sda1
).
root-device-type
- The type of the root device volume (ebs
| instance-store
).
source-dest-check
- Indicates whether the instance performs source/destination checking. A value of true
means that checking is enabled, and false
means that checking is disabled. The value must be false
for the instance to perform network address translation (NAT) in your VPC.
spot-instance-request-id
- The ID of the Spot Instance request.
state-reason-code
- The reason code for the state change.
state-reason-message
- A message that describes the state change.
subnet-id
- The ID of the subnet for the instance.
tag:<key>
- The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner
and the value TeamA
, specify tag:Owner
for the filter name and TeamA
for the filter value.
tag-key
- The key of a tag assigned to the resource. Use this filter to find all resources that have a tag with a specific key, regardless of the tag value.
tenancy
- The tenancy of an instance (dedicated
| default
| host
).
tpm-support
- Indicates if the instance is configured for NitroTPM support (v2.0
).
usage-operation
- The usage operation value for the instance (RunInstances
| RunInstances:00g0
| RunInstances:0010
| RunInstances:1010
| RunInstances:1014
| RunInstances:1110
| RunInstances:0014
| RunInstances:0210
| RunInstances:0110
| RunInstances:0100
| RunInstances:0004
| RunInstances:0200
| RunInstances:000g
| RunInstances:0g00
| RunInstances:0002
| RunInstances:0800
| RunInstances:0102
| RunInstances:0006
| RunInstances:0202
).
usage-operation-update-time
- The time that the usage operation was last updated, for example, 2022-09-15T17:15:20.000Z
.
virtualization-type
- The virtualization type of the instance (paravirtual
| hvm
).
vpc-id
- The ID of the VPC that the instance is running in.
ENA Express uses Amazon Web Services Scalable Reliable Datagram (SRD) technology to increase the maximum bandwidth used per stream and minimize tail latency of network traffic between EC2 instances. With ENA Express, you can communicate between two EC2 instances in the same subnet within the same account, or in different accounts. Both sending and receiving instances must have ENA Express enabled.
To improve the reliability of network packet delivery, ENA Express reorders network packets on the receiving end by default. However, some UDP-based applications are designed to handle network packets that are out of order to reduce the overhead for packet delivery at the network layer. When ENA Express is enabled, you can specify whether UDP network traffic uses it.
" }, + "EnaSrdSpecificationRequest": { + "type": "structure", + "members": { + "EnaSrdEnabled": { + "shape": "Boolean", + "documentation": "Specifies whether ENA Express is enabled for the network interface when you launch an instance from your launch template.
" + }, + "EnaSrdUdpSpecification": { + "shape": "EnaSrdUdpSpecificationRequest", + "documentation": "Contains ENA Express settings for UDP network traffic in your launch template.
" + } + }, + "documentation": "Launch instances with ENA Express settings configured from your launch template.
" + }, "EnaSrdSupported": { "type": "boolean" }, @@ -29611,10 +29625,20 @@ "members": { "EnaSrdUdpEnabled": { "shape": "Boolean", - "documentation": "Indicates whether UDP traffic uses ENA Express. To specify this setting, you must first enable ENA Express.
" + "documentation": "Indicates whether UDP traffic to and from the instance uses ENA Express. To specify this setting, you must first enable ENA Express.
" } }, - "documentation": "ENA Express is compatible with both TCP and UDP transport protocols. When it’s enabled, TCP traffic automatically uses it. However, some UDP-based applications are designed to handle network packets that are out of order, without a need for retransmission, such as live video broadcasting or other near-real-time applications. For UDP traffic, you can specify whether to use ENA Express, based on your application environment needs.
" + "documentation": "ENA Express is compatible with both TCP and UDP transport protocols. When it's enabled, TCP traffic automatically uses it. However, some UDP-based applications are designed to handle network packets that are out of order, without a need for retransmission, such as live video broadcasting or other near-real-time applications. For UDP traffic, you can specify whether to use ENA Express, based on your application environment needs.
" + }, + "EnaSrdUdpSpecificationRequest": { + "type": "structure", + "members": { + "EnaSrdUdpEnabled": { + "shape": "Boolean", + "documentation": "Indicates whether UDP traffic uses ENA Express for your instance. To ensure that UDP traffic can use ENA Express when you launch an instance, you must also set EnaSrdEnabled in the EnaSrdSpecificationRequest to true
in your launch template.
Configures ENA Express for UDP network traffic from your launch template.
" }, "EnaSupport": { "type": "string", @@ -36426,6 +36450,33 @@ }, "documentation": "Describes an instance.
" }, + "InstanceAttachmentEnaSrdSpecification": { + "type": "structure", + "members": { + "EnaSrdEnabled": { + "shape": "Boolean", + "documentation": "Indicates whether ENA Express is enabled for the network interface.
", + "locationName": "enaSrdEnabled" + }, + "EnaSrdUdpSpecification": { + "shape": "InstanceAttachmentEnaSrdUdpSpecification", + "documentation": "Configures ENA Express for UDP network traffic.
", + "locationName": "enaSrdUdpSpecification" + } + }, + "documentation": "ENA Express uses Amazon Web Services Scalable Reliable Datagram (SRD) technology to increase the maximum bandwidth used per stream and minimize tail latency of network traffic between EC2 instances. With ENA Express, you can communicate between two EC2 instances in the same subnet within the same account, or in different accounts. Both sending and receiving instances must have ENA Express enabled.
To improve the reliability of network packet delivery, ENA Express reorders network packets on the receiving end by default. However, some UDP-based applications are designed to handle network packets that are out of order to reduce the overhead for packet delivery at the network layer. When ENA Express is enabled, you can specify whether UDP network traffic uses it.
" + }, + "InstanceAttachmentEnaSrdUdpSpecification": { + "type": "structure", + "members": { + "EnaSrdUdpEnabled": { + "shape": "Boolean", + "documentation": "Indicates whether UDP traffic to and from the instance uses ENA Express. To specify this setting, you must first enable ENA Express.
", + "locationName": "enaSrdUdpEnabled" + } + }, + "documentation": "ENA Express is compatible with both TCP and UDP transport protocols. When it's enabled, TCP traffic automatically uses it. However, some UDP-based applications are designed to handle network packets that are out of order, without a need for retransmission, such as live video broadcasting or other near-real-time applications. For UDP traffic, you can specify whether to use ENA Express, based on your application environment needs.
" + }, "InstanceAttribute": { "type": "structure", "members": { @@ -37437,6 +37488,11 @@ "shape": "Integer", "documentation": "The index of the network card.
", "locationName": "networkCardIndex" + }, + "EnaSrdSpecification": { + "shape": "InstanceAttachmentEnaSrdSpecification", + "documentation": "Contains the ENA Express settings for the network interface that's attached to the instance.
", + "locationName": "enaSrdSpecification" } }, "documentation": "Describes a network interface attachment.
" @@ -37546,6 +37602,10 @@ "PrimaryIpv6": { "shape": "Boolean", "documentation": "The primary IPv6 address of the network interface. When you enable an IPv6 GUA address to be a primary IPv6, the first IPv6 GUA will be made the primary IPv6 address until the instance is terminated or the network interface is detached. For more information about primary IPv6 addresses, see RunInstances.
" + }, + "EnaSrdSpecification": { + "shape": "EnaSrdSpecificationRequest", + "documentation": "Specifies the ENA Express settings for the network interface that's attached to the instance.
" } }, "documentation": "Describes a network interface.
" @@ -41282,6 +41342,33 @@ "locationName": "item" } }, + "LaunchTemplateEnaSrdSpecification": { + "type": "structure", + "members": { + "EnaSrdEnabled": { + "shape": "Boolean", + "documentation": "Indicates whether ENA Express is enabled for the network interface.
", + "locationName": "enaSrdEnabled" + }, + "EnaSrdUdpSpecification": { + "shape": "LaunchTemplateEnaSrdUdpSpecification", + "documentation": "Configures ENA Express for UDP network traffic.
", + "locationName": "enaSrdUdpSpecification" + } + }, + "documentation": "ENA Express uses Amazon Web Services Scalable Reliable Datagram (SRD) technology to increase the maximum bandwidth used per stream and minimize tail latency of network traffic between EC2 instances. With ENA Express, you can communicate between two EC2 instances in the same subnet within the same account, or in different accounts. Both sending and receiving instances must have ENA Express enabled.
To improve the reliability of network packet delivery, ENA Express reorders network packets on the receiving end by default. However, some UDP-based applications are designed to handle network packets that are out of order to reduce the overhead for packet delivery at the network layer. When ENA Express is enabled, you can specify whether UDP network traffic uses it.
" + }, + "LaunchTemplateEnaSrdUdpSpecification": { + "type": "structure", + "members": { + "EnaSrdUdpEnabled": { + "shape": "Boolean", + "documentation": "Indicates whether UDP traffic to and from the instance uses ENA Express. To specify this setting, you must first enable ENA Express.
", + "locationName": "enaSrdUdpEnabled" + } + }, + "documentation": "ENA Express is compatible with both TCP and UDP transport protocols. When it's enabled, TCP traffic automatically uses it. However, some UDP-based applications are designed to handle network packets that are out of order, without a need for retransmission, such as live video broadcasting or other near-real-time applications. For UDP traffic, you can specify whether to use ENA Express, based on your application environment needs.
" + }, "LaunchTemplateEnclaveOptions": { "type": "structure", "members": { @@ -41625,6 +41712,11 @@ "shape": "Boolean", "documentation": "The primary IPv6 address of the network interface. When you enable an IPv6 GUA address to be a primary IPv6, the first IPv6 GUA will be made the primary IPv6 address until the instance is terminated or the network interface is detached. For more information about primary IPv6 addresses, see RunInstances.
", "locationName": "primaryIpv6" + }, + "EnaSrdSpecification": { + "shape": "LaunchTemplateEnaSrdSpecification", + "documentation": "Contains the ENA Express settings for instances launched from your launch template.
", + "locationName": "enaSrdSpecification" } }, "documentation": "Describes a network interface.
" @@ -41721,6 +41813,10 @@ "PrimaryIpv6": { "shape": "Boolean", "documentation": "The primary IPv6 address of the network interface. When you enable an IPv6 GUA address to be a primary IPv6, the first IPv6 GUA will be made the primary IPv6 address until the instance is terminated or the network interface is detached. For more information about primary IPv6 addresses, see RunInstances.
" + }, + "EnaSrdSpecification": { + "shape": "EnaSrdSpecificationRequest", + "documentation": "Configure ENA Express settings for your launch template.
" } }, "documentation": "The parameters for a network interface.
" @@ -42070,7 +42166,7 @@ "members": { "ResourceType": { "shape": "ResourceType", - "documentation": "The type of resource to tag.
Valid Values lists all resource types for Amazon EC2 that can be tagged. When you create a launch template, you can specify tags for the following resource types only: instance
| volume
| elastic-gpu
| network-interface
| spot-instances-request
. If the instance does include the resource type that you specify, the instance launch fails. For example, not all instance types include an Elastic GPU.
To tag a resource after it has been created, see CreateTags.
" + "documentation": "The type of resource to tag.
Valid Values lists all resource types for Amazon EC2 that can be tagged. When you create a launch template, you can specify tags for the following resource types only: instance
| volume
| elastic-gpu
| network-interface
| spot-instances-request
. If the instance does not include the resource type that you specify, the instance launch fails. For example, not all instance types include an Elastic GPU.
To tag a resource after it has been created, see CreateTags.
" }, "Tags": { "shape": "TagList", @@ -50929,12 +51025,12 @@ }, "SecurityGroupIds": { "shape": "SecurityGroupIdStringList", - "documentation": "One or more security group IDs. You can create a security group using CreateSecurityGroup. You cannot specify both a security group ID and security name in the same request.
", + "documentation": "One or more security group IDs. You can create a security group using CreateSecurityGroup.
", "locationName": "SecurityGroupId" }, "SecurityGroups": { "shape": "SecurityGroupStringList", - "documentation": "One or more security group names. For a nondefault VPC, you must use security group IDs instead. You cannot specify both a security group ID and security name in the same request.
", + "documentation": "One or more security group names. For a nondefault VPC, you must use security group IDs instead.
", "locationName": "SecurityGroup" }, "InstanceMarketOptions": { diff --git a/apis/entitlement.marketplace-2017-01-11.normal.json b/apis/entitlement.marketplace-2017-01-11.normal.json index acdee34305..210c215dbd 100644 --- a/apis/entitlement.marketplace-2017-01-11.normal.json +++ b/apis/entitlement.marketplace-2017-01-11.normal.json @@ -1,183 +1,194 @@ { - "version":"2.0", - "metadata":{ - "apiVersion":"2017-01-11", - "endpointPrefix":"entitlement.marketplace", - "jsonVersion":"1.1", - "protocol":"json", - "serviceFullName":"AWS Marketplace Entitlement Service", - "serviceId":"Marketplace Entitlement Service", - "signatureVersion":"v4", - "signingName":"aws-marketplace", - "targetPrefix":"AWSMPEntitlementService", - "uid":"entitlement.marketplace-2017-01-11" + "version": "2.0", + "metadata": { + "apiVersion": "2017-01-11", + "endpointPrefix": "entitlement.marketplace", + "jsonVersion": "1.1", + "protocol": "json", + "serviceFullName": "AWS Marketplace Entitlement Service", + "serviceId": "Marketplace Entitlement Service", + "signatureVersion": "v4", + "signingName": "aws-marketplace", + "targetPrefix": "AWSMPEntitlementService", + "uid": "entitlement.marketplace-2017-01-11" }, - "operations":{ - "GetEntitlements":{ - "name":"GetEntitlements", - "http":{ - "method":"POST", - "requestUri":"/" + "operations": { + "GetEntitlements": { + "name": "GetEntitlements", + "http": { + "method": "POST", + "requestUri": "/" }, - "input":{"shape":"GetEntitlementsRequest"}, - "output":{"shape":"GetEntitlementsResult"}, - "errors":[ - {"shape":"InvalidParameterException"}, - {"shape":"ThrottlingException"}, - {"shape":"InternalServiceErrorException"} + "input": { + "shape": "GetEntitlementsRequest" + }, + "output": { + "shape": "GetEntitlementsResult" + }, + "errors": [ + { + "shape": "InvalidParameterException" + }, + { + "shape": "ThrottlingException" + }, + { + "shape": "InternalServiceErrorException" + } ], - "documentation":"GetEntitlements retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions.
" + "documentation": "GetEntitlements retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions.
" } }, - "shapes":{ - "Boolean":{"type":"boolean"}, - "Double":{"type":"double"}, - "Entitlement":{ - "type":"structure", - "members":{ - "ProductCode":{ - "shape":"ProductCode", - "documentation":"The product code for which the given entitlement applies. Product codes are provided by AWS Marketplace when the product listing is created.
" + "shapes": { + "Boolean": { + "type": "boolean" + }, + "Double": { + "type": "double" + }, + "Entitlement": { + "type": "structure", + "members": { + "ProductCode": { + "shape": "ProductCode", + "documentation": "The product code for which the given entitlement applies. Product codes are provided by AWS Marketplace when the product listing is created.
" }, - "Dimension":{ - "shape":"NonEmptyString", - "documentation":"The dimension for which the given entitlement applies. Dimensions represent categories of capacity in a product and are specified when the product is listed in AWS Marketplace.
" + "Dimension": { + "shape": "NonEmptyString", + "documentation": "The dimension for which the given entitlement applies. Dimensions represent categories of capacity in a product and are specified when the product is listed in AWS Marketplace.
" }, - "CustomerIdentifier":{ - "shape":"NonEmptyString", - "documentation":"The customer identifier is a handle to each unique customer in an application. Customer identifiers are obtained through the ResolveCustomer operation in AWS Marketplace Metering Service.
" + "CustomerIdentifier": { + "shape": "NonEmptyString", + "documentation": "The customer identifier is a handle to each unique customer in an application. Customer identifiers are obtained through the ResolveCustomer operation in AWS Marketplace Metering Service.
" }, - "Value":{ - "shape":"EntitlementValue", - "documentation":"The EntitlementValue represents the amount of capacity that the customer is entitled to for the product.
" + "Value": { + "shape": "EntitlementValue", + "documentation": "The EntitlementValue represents the amount of capacity that the customer is entitled to for the product.
" }, - "ExpirationDate":{ - "shape":"Timestamp", - "documentation":"The expiration date represents the minimum date through which this entitlement is expected to remain valid. For contractual products listed on AWS Marketplace, the expiration date is the date at which the customer will renew or cancel their contract. Customers who are opting to renew their contract will still have entitlements with an expiration date.
" + "ExpirationDate": { + "shape": "Timestamp", + "documentation": "The expiration date represents the minimum date through which this entitlement is expected to remain valid. For contractual products listed on AWS Marketplace, the expiration date is the date at which the customer will renew or cancel their contract. Customers who are opting to renew their contract will still have entitlements with an expiration date.
" } }, - "documentation":"An entitlement represents capacity in a product owned by the customer. For example, a customer might own some number of users or seats in an SaaS application or some amount of data capacity in a multi-tenant database.
" - }, - "EntitlementList":{ - "type":"list", - "member":{"shape":"Entitlement"}, - "min":0 - }, - "EntitlementValue":{ - "type":"structure", - "members":{ - "IntegerValue":{ - "shape":"Integer", - "documentation":"The IntegerValue field will be populated with an integer value when the entitlement is an integer type. Otherwise, the field will not be set.
" + "documentation": "An entitlement represents capacity in a product owned by the customer. For example, a customer might own some number of users or seats in an SaaS application or some amount of data capacity in a multi-tenant database.
" + }, + "EntitlementList": { + "type": "list", + "member": { + "shape": "Entitlement" + }, + "min": 0 + }, + "EntitlementValue": { + "type": "structure", + "members": { + "IntegerValue": { + "shape": "Integer", + "documentation": "The IntegerValue field will be populated with an integer value when the entitlement is an integer type. Otherwise, the field will not be set.
" }, - "DoubleValue":{ - "shape":"Double", - "documentation":"The DoubleValue field will be populated with a double value when the entitlement is a double type. Otherwise, the field will not be set.
" + "DoubleValue": { + "shape": "Double", + "documentation": "The DoubleValue field will be populated with a double value when the entitlement is a double type. Otherwise, the field will not be set.
" }, - "BooleanValue":{ - "shape":"Boolean", - "documentation":"The BooleanValue field will be populated with a boolean value when the entitlement is a boolean type. Otherwise, the field will not be set.
" + "BooleanValue": { + "shape": "Boolean", + "documentation": "The BooleanValue field will be populated with a boolean value when the entitlement is a boolean type. Otherwise, the field will not be set.
" }, - "StringValue":{ - "shape":"String", - "documentation":"The StringValue field will be populated with a string value when the entitlement is a string type. Otherwise, the field will not be set.
" + "StringValue": { + "shape": "String", + "documentation": "The StringValue field will be populated with a string value when the entitlement is a string type. Otherwise, the field will not be set.
" } }, - "documentation":"The EntitlementValue represents the amount of capacity that the customer is entitled to for the product.
" - }, - "ErrorMessage":{"type":"string"}, - "FilterValue":{"type":"string"}, - "FilterValueList":{ - "type":"list", - "member":{"shape":"FilterValue"}, - "min":1 - }, - "GetEntitlementFilterName":{ - "type":"string", - "enum":[ + "documentation": "The EntitlementValue represents the amount of capacity that the customer is entitled to for the product.
" + }, + "FilterValue": { + "type": "string" + }, + "FilterValueList": { + "type": "list", + "member": { + "shape": "FilterValue" + }, + "min": 1 + }, + "GetEntitlementFilterName": { + "type": "string", + "enum": [ "CUSTOMER_IDENTIFIER", "DIMENSION" ] }, - "GetEntitlementFilters":{ - "type":"map", - "key":{"shape":"GetEntitlementFilterName"}, - "value":{"shape":"FilterValueList"} - }, - "GetEntitlementsRequest":{ - "type":"structure", - "required":["ProductCode"], - "members":{ - "ProductCode":{ - "shape":"ProductCode", - "documentation":"Product code is used to uniquely identify a product in AWS Marketplace. The product code will be provided by AWS Marketplace when the product listing is created.
" + "GetEntitlementFilters": { + "type": "map", + "key": { + "shape": "GetEntitlementFilterName" + }, + "value": { + "shape": "FilterValueList" + } + }, + "GetEntitlementsRequest": { + "type": "structure", + "required": [ + "ProductCode" + ], + "members": { + "ProductCode": { + "shape": "ProductCode", + "documentation": "Product code is used to uniquely identify a product in AWS Marketplace. The product code will be provided by AWS Marketplace when the product listing is created.
" }, - "Filter":{ - "shape":"GetEntitlementFilters", - "documentation":"Filter is used to return entitlements for a specific customer or for a specific dimension. Filters are described as keys mapped to a lists of values. Filtered requests are unioned for each value in the value list, and then intersected for each filter key.
" + "Filter": { + "shape": "GetEntitlementFilters", + "documentation": "Filter is used to return entitlements for a specific customer or for a specific dimension. Filters are described as keys mapped to a lists of values. Filtered requests are unioned for each value in the value list, and then intersected for each filter key.
" }, - "NextToken":{ - "shape":"NonEmptyString", - "documentation":"For paginated calls to GetEntitlements, pass the NextToken from the previous GetEntitlementsResult.
" + "NextToken": { + "shape": "NonEmptyString", + "documentation": "For paginated calls to GetEntitlements, pass the NextToken from the previous GetEntitlementsResult.
" }, - "MaxResults":{ - "shape":"Integer", - "documentation":"The maximum number of items to retrieve from the GetEntitlements operation. For pagination, use the NextToken field in subsequent calls to GetEntitlements.
" + "MaxResults": { + "shape": "PageSizeInteger", + "documentation": "The maximum number of items to retrieve from the GetEntitlements operation. For pagination, use the NextToken field in subsequent calls to GetEntitlements.
" } }, - "documentation":"The GetEntitlementsRequest contains parameters for the GetEntitlements operation.
" - }, - "GetEntitlementsResult":{ - "type":"structure", - "members":{ - "Entitlements":{ - "shape":"EntitlementList", - "documentation":"The set of entitlements found through the GetEntitlements operation. If the result contains an empty set of entitlements, NextToken might still be present and should be used.
" + "documentation": "The GetEntitlementsRequest contains parameters for the GetEntitlements operation.
" + }, + "GetEntitlementsResult": { + "type": "structure", + "members": { + "Entitlements": { + "shape": "EntitlementList", + "documentation": "The set of entitlements found through the GetEntitlements operation. If the result contains an empty set of entitlements, NextToken might still be present and should be used.
" }, - "NextToken":{ - "shape":"NonEmptyString", - "documentation":"For paginated results, use NextToken in subsequent calls to GetEntitlements. If the result contains an empty set of entitlements, NextToken might still be present and should be used.
" + "NextToken": { + "shape": "NonEmptyString", + "documentation": "For paginated results, use NextToken in subsequent calls to GetEntitlements. If the result contains an empty set of entitlements, NextToken might still be present and should be used.
" } }, - "documentation":"The GetEntitlementsRequest contains results from the GetEntitlements operation.
" + "documentation": "The GetEntitlementsRequest contains results from the GetEntitlements operation.
" }, - "Integer":{"type":"integer"}, - "InternalServiceErrorException":{ - "type":"structure", - "members":{ - "message":{"shape":"ErrorMessage"} - }, - "documentation":"An internal error has occurred. Retry your request. If the problem persists, post a message with details on the AWS forums.
", - "exception":true, - "fault":true - }, - "InvalidParameterException":{ - "type":"structure", - "members":{ - "message":{"shape":"ErrorMessage"} - }, - "documentation":"One or more parameters in your request was invalid.
", - "exception":true - }, - "NonEmptyString":{ - "type":"string", - "pattern":"\\S+" - }, - "ProductCode":{ - "type":"string", - "max":255, - "min":1 - }, - "String":{"type":"string"}, - "ThrottlingException":{ - "type":"structure", - "members":{ - "message":{"shape":"ErrorMessage"} - }, - "documentation":"The calls to the GetEntitlements API are throttled.
", - "exception":true + "Integer": { + "type": "integer" + }, + "NonEmptyString": { + "type": "string", + "pattern": "\\S+" + }, + "PageSizeInteger": { + "type": "integer", + "max": 25, + "min": 1 }, - "Timestamp":{"type":"timestamp"} + "ProductCode": { + "type": "string", + "max": 255, + "min": 1 + }, + "String": { + "type": "string" + }, + "Timestamp": { + "type": "timestamp" + } }, - "documentation":"This reference provides descriptions of the AWS Marketplace Entitlement Service API.
AWS Marketplace Entitlement Service is used to determine the entitlement of a customer to a given product. An entitlement represents capacity in a product owned by the customer. For example, a customer might own some number of users or seats in an SaaS application or some amount of data capacity in a multi-tenant database.
Getting Entitlement Records
GetEntitlements- Gets the entitlements for a Marketplace product.
This reference provides descriptions of the AWS Marketplace Entitlement Service API.
AWS Marketplace Entitlement Service is used to determine the entitlement of a customer to a given product. An entitlement represents capacity in a product owned by the customer. For example, a customer might own some number of users or seats in an SaaS application or some amount of data capacity in a multi-tenant database.
Getting Entitlement Records
GetEntitlements- Gets the entitlements for a Marketplace product.
Creates an Firewall Manager policy.
Firewall Manager provides the following types of policies:
An WAF policy (type WAFV2), which defines rule groups to run first in the corresponding WAF web ACL and rule groups to run last in the web ACL.
An WAF Classic policy (type WAF), which defines a rule group.
A Shield Advanced policy, which applies Shield Advanced protection to specified accounts and resources.
A security group policy, which manages VPC security groups across your Amazon Web Services organization.
An Network Firewall policy, which provides firewall rules to filter network traffic in specified Amazon VPCs.
A DNS Firewall policy, which provides Route 53 Resolver DNS Firewall rules to filter DNS queries for specified VPCs.
Each policy is specific to one of the types. If you want to enforce more than one policy type across accounts, create multiple policies. You can create multiple policies for each type.
You must be subscribed to Shield Advanced to create a Shield Advanced policy. For more information about subscribing to Shield Advanced, see CreateSubscription.
" + "documentation": "Creates an Firewall Manager policy.
A Firewall Manager policy is specific to the individual policy type. If you want to enforce multiple policy types across accounts, you can create multiple policies. You can create more than one policy for each type.
If you add a new account to an organization that you created with Organizations, Firewall Manager automatically applies the policy to the resources in that account that are within scope of the policy.
Firewall Manager provides the following types of policies:
Shield Advanced policy - This policy applies Shield Advanced protection to specified accounts and resources.
Security Groups policy - This type of policy gives you control over security groups that are in use throughout your organization in Organizations and lets you enforce a baseline set of rules across your organization.
Network Firewall policy - This policy applies Network Firewall protection to your organization's VPCs.
DNS Firewall policy - This policy applies Amazon Route 53 Resolver DNS Firewall protections to your organization's VPCs.
Third-party firewall policy - This policy applies third-party firewall protections. Third-party firewalls are available by subscription through the Amazon Web Services Marketplace console at Amazon Web Services Marketplace.
Palo Alto Networks Cloud NGFW policy - This policy applies Palo Alto Networks Cloud Next Generation Firewall (NGFW) protections and Palo Alto Networks Cloud NGFW rulestacks to your organization's VPCs.
Fortigate CNF policy - This policy applies Fortigate Cloud Native Firewall (CNF) protections. Fortigate CNF is a cloud-centered solution that blocks Zero-Day threats and secures cloud infrastructures with industry-leading advanced threat prevention, smart web application firewalls (WAF), and API protection.
If True
, the request performs cleanup according to the policy type.
For WAF and Shield Advanced policies, the cleanup does the following:
Deletes rule groups created by Firewall Manager
Removes web ACLs from in-scope resources
Deletes web ACLs that contain no rules or rule groups
For security group policies, the cleanup does the following for each security group in the policy:
Disassociates the security group from in-scope resources
Deletes the security group if it was created through Firewall Manager and if it's no longer associated with any resources through another policy
After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protection of out-of-scope resources remains unchanged. Scope is determined by tags that you create and accounts that you associate with the policy. When creating the policy, if you specify that only resources in specific accounts or with specific tags are in scope of the policy, those accounts and resources are handled by the policy. All others are out of scope. If you don't specify tags or accounts, all resources are in scope.
" + "documentation": "If True
, the request performs cleanup according to the policy type.
For WAF and Shield Advanced policies, the cleanup does the following:
Deletes rule groups created by Firewall Manager
Removes web ACLs from in-scope resources
Deletes web ACLs that contain no rules or rule groups
For security group policies, the cleanup does the following for each security group in the policy:
Disassociates the security group from in-scope resources
Deletes the security group if it was created through Firewall Manager and if it's no longer associated with any resources through another policy
For security group common policies, even if set to False
, Firewall Manager deletes all security groups created by Firewall Manager that aren't associated with any other resources through another policy.
After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protection of out-of-scope resources remains unchanged. Scope is determined by tags that you create and accounts that you associate with the policy. When creating the policy, if you specify that only resources in specific accounts or with specific tags are in scope of the policy, those accounts and resources are handled by the policy. All others are out of scope. If you don't specify tags or accounts, all resources are in scope.
" } } }, @@ -2447,7 +2447,7 @@ "members": { "PolicyId": { "shape": "PolicyId", - "documentation": "The ID of the Firewall Manager policy that you want the details for. This currently only supports security group content audit policies.
" + "documentation": "The ID of the Firewall Manager policy that you want the details for. You can get violation details for the following policy types:
DNS Firewall
Imported Network Firewall
Network Firewall
Security group content audit
Third-party firewall
The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon Web Services Resource Types Reference. To apply this policy to multiple resource types, specify a resource type of ResourceTypeList
and then specify the resource types in a ResourceTypeList
.
For WAF and Shield Advanced, resource types include AWS::ElasticLoadBalancingV2::LoadBalancer
, AWS::ElasticLoadBalancing::LoadBalancer
, AWS::EC2::EIP
, and AWS::CloudFront::Distribution
. For a security group common policy, valid values are AWS::EC2::NetworkInterface
and AWS::EC2::Instance
. For a security group content audit policy, valid values are AWS::EC2::SecurityGroup
, AWS::EC2::NetworkInterface
, and AWS::EC2::Instance
. For a security group usage audit policy, the value is AWS::EC2::SecurityGroup
. For an Network Firewall policy or DNS Firewall policy, the value is AWS::EC2::VPC
.
The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon Web Services Resource Types Reference. To apply this policy to multiple resource types, specify a resource type of ResourceTypeList
and then specify the resource types in a ResourceTypeList
.
The following are valid resource types for each Firewall Manager policy type:
Amazon Web Services WAF Classic - AWS::ApiGateway::Stage
, AWS::CloudFront::Distribution
, and AWS::ElasticLoadBalancingV2::LoadBalancer
.
WAF - AWS::ApiGateway::Stage
, AWS::ElasticLoadBalancingV2::LoadBalancer
, and AWS::CloudFront::Distribution
.
DNS Firewall, Network Firewall, and third-party firewall - AWS::EC2::VPC
.
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer
, AWS::ElasticLoadBalancing::LoadBalancer
, AWS::EC2::EIP
, and AWS::CloudFront::Distribution
.
Security group content audit - AWS::EC2::SecurityGroup
, AWS::EC2::NetworkInterface
, and AWS::EC2::Instance
.
Security group usage audit - AWS::EC2::SecurityGroup
.
Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL
\"{\\\"type\\\":\\\"DNS_FIREWALL\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-1\\\",\\\"priority\\\":10}],\\\"postProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-2\\\",\\\"priority\\\":9911}]}\"
Valid values for preProcessRuleGroups
are between 1 and 99. Valid values for postProcessRuleGroups
are between 9901 and 10000.
Example: IMPORT_NETWORK_FIREWALL
\"{\\\"type\\\":\\\"IMPORT_NETWORK_FIREWALL\\\",\\\"awsNetworkFirewallConfig\\\":{\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\\/rg1\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:drop\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:pass\\\"],\\\"networkFirewallStatelessCustomActions\\\":[],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\\/ThreatSignaturesEmergingEventsStrictOrder\\\",\\\"priority\\\":8}],\\\"networkFirewallStatefulEngineOptions\\\":{\\\"ruleOrder\\\":\\\"STRICT_ORDER\\\"},\\\"networkFirewallStatefulDefaultActions\\\":[\\\"aws:drop_strict\\\"]}}\"
\"{\\\"type\\\":\\\"DNS_FIREWALL\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-1\\\",\\\"priority\\\":10}],\\\"postProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-2\\\",\\\"priority\\\":9911}]}\"
Valid values for preProcessRuleGroups
are between 1 and 99. Valid values for postProcessRuleGroups
are between 9901 and 10000.
Example: NETWORK_FIREWALL
- Centralized deployment model
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"awsNetworkFirewallConfig\\\":{\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":true}},\\\"firewallDeploymentModel\\\":{\\\"centralizedFirewallDeploymentModel\\\":{\\\"centralizedFirewallOrchestrationConfig\\\":{\\\"inspectionVpcIds\\\":[{\\\"resourceId\\\":\\\"vpc-1234\\\",\\\"accountId\\\":\\\"123456789011\\\"}],\\\"firewallCreationConfig\\\":{\\\"endpointLocation\\\":{\\\"availabilityZoneConfigList\\\":[{\\\"availabilityZoneId\\\":null,\\\"availabilityZoneName\\\":\\\"us-east-1a\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]}]}},\\\"allowedIPV4CidrList\\\":[]}}}}\"
To use the centralized deployment model, you must set PolicyOption to CENTRALIZED
.
Example: NETWORK_FIREWALL
- Distributed deployment model with automatic Availability Zone configuration
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\",\\\"192.168.0.0/28\\\"],\\\"routeManagementAction\\\":\\\"OFF\\\"},\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":true}}\"
With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create the endpoints in. To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: NETWORK_FIREWALL
- Distributed deployment model with automatic Availability Zone configuration and route management
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\",\\\"192.168.0.0/28\\\"],\\\"routeManagementAction\\\":\\\"MONITOR\\\",\\\"routeManagementTargetTypes\\\":[\\\"InternetGateway\\\"]},\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\": \\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":true}}\"
To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: NETWORK_FIREWALL
- Distributed deployment model with custom Availability Zone configuration
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"fragmentcustomactionname\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\", \\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}},{\\\"actionName\\\":\\\"fragmentcustomactionname\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"fragmentmetricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"firewallCreationConfig\\\":{ \\\"endpointLocation\\\":{\\\"availabilityZoneConfigList\\\":[{\\\"availabilityZoneName\\\":\\\"us-east-1a\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]},{\\\"availabilityZoneName\\\":\\\"us-east-1b\\\",\\\"allowedIPV4CidrList\\\":[ \\\"10.0.0.0/28\\\"]}]} },\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":null,\\\"routeManagementAction\\\":\\\"OFF\\\",\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":boolean}}\"
With custom Availability Zone configuration, you define which specific Availability Zones to create endpoints in by configuring firewallCreationConfig
. To configure the Availability Zones in firewallCreationConfig
, specify either the availabilityZoneName
or availabilityZoneId
parameter, not both parameters.
To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: NETWORK_FIREWALL
- Distributed deployment model with custom Availability Zone configuration and route management
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"fragmentcustomactionname\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}},{\\\"actionName\\\":\\\"fragmentcustomactionname\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"fragmentmetricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"firewallCreationConfig\\\":{\\\"endpointLocation\\\":{\\\"availabilityZoneConfigList\\\":[{\\\"availabilityZoneName\\\":\\\"us-east-1a\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]},{\\\"availabilityZoneName\\\":\\\"us-east-1b\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]}]}},\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":null,\\\"routeManagementAction\\\":\\\"MONITOR\\\",\\\"routeManagementTargetTypes\\\":[\\\"InternetGateway\\\"],\\\"routeManagementConfig\\\":{\\\"allowCrossAZTrafficIfNoEndpoint\\\":true}},\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":boolean}}\"
To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: THIRD_PARTY_FIREWALL
\"{ \"type\":\"THIRD_PARTY_FIREWALL\", \"thirdPartyFirewall\":\"PALO_ALTO_NETWORKS_CLOUD_NGFW\", \"thirdPartyFirewallConfig\":{ \"thirdPartyFirewallPolicyList\":[\"global-1\"] }, \"firewallDeploymentModel\":{ \"distributedFirewallDeploymentModel\":{ \"distributedFirewallOrchestrationConfig\":{ \"firewallCreationConfig\":{ \"endpointLocation\":{ \"availabilityZoneConfigList\":[ { \"availabilityZoneName\":\"${AvailabilityZone}\" } ] } }, \"allowedIPV4CidrList\":[ ] } } } }\"
Example: SECURITY_GROUPS_COMMON
\"{\\\"type\\\":\\\"SECURITY_GROUPS_COMMON\\\",\\\"revertManualSecurityGroupChanges\\\":false,\\\"exclusiveResourceSecurityGroupManagement\\\":false, \\\"applyToAllEC2InstanceENIs\\\":false,\\\"securityGroups\\\":[{\\\"id\\\":\\\" sg-000e55995d61a06bd\\\"}]}\"
Example: SECURITY_GROUPS_COMMON
- Security group tag distribution
\"\"{\\\"type\\\":\\\"SECURITY_GROUPS_COMMON\\\",\\\"securityGroups\\\":[{\\\"id\\\":\\\"sg-000e55995d61a06bd\\\"}],\\\"revertManualSecurityGroupChanges\\\":true,\\\"exclusiveResourceSecurityGroupManagement\\\":false,\\\"applyToAllEC2InstanceENIs\\\":false,\\\"includeSharedVPC\\\":false,\\\"enableTagDistribution\\\":true}\"\"
Firewall Manager automatically distributes tags from the primary group to the security groups created by this policy. To use security group tag distribution, you must also set revertManualSecurityGroupChanges
to true
, otherwise Firewall Manager won't be able to create the policy. When you enable revertManualSecurityGroupChanges
, Firewall Manager identifies and reports when the security groups created by this policy become non-compliant.
Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica security groups. System tags begin with the aws:
prefix.
Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns
\"{\\\"type\\\":\\\"SECURITY_GROUPS_COMMON\\\",\\\"revertManualSecurityGroupChanges\\\":false,\\\"exclusiveResourceSecurityGroupManagement\\\":false, \\\"applyToAllEC2InstanceENIs\\\":false,\\\"includeSharedVPC\\\":true,\\\"securityGroups\\\":[{\\\"id\\\":\\\" sg-000e55995d61a06bd\\\"}]}\"
Example: SECURITY_GROUPS_CONTENT_AUDIT
\"{\\\"type\\\":\\\"SECURITY_GROUPS_CONTENT_AUDIT\\\",\\\"securityGroups\\\":[{\\\"id\\\":\\\"sg-000e55995d61a06bd\\\"}],\\\"securityGroupAction\\\":{\\\"type\\\":\\\"ALLOW\\\"}}\"
The security group action for content audit can be ALLOW
or DENY
. For ALLOW
, all in-scope security group rules must be within the allowed range of the policy's security group rules. For DENY
, all in-scope security group rules must not contain a value or a range that matches a rule value or range in the policy security group.
Example: SECURITY_GROUPS_USAGE_AUDIT
\"{\\\"type\\\":\\\"SECURITY_GROUPS_USAGE_AUDIT\\\",\\\"deleteUnusedSecurityGroups\\\":true,\\\"coalesceRedundantSecurityGroups\\\":true}\"
Specification for SHIELD_ADVANCED
for Amazon CloudFront distributions
\"{\\\"type\\\":\\\"SHIELD_ADVANCED\\\",\\\"automaticResponseConfiguration\\\": {\\\"automaticResponseStatus\\\":\\\"ENABLED|IGNORED|DISABLED\\\", \\\"automaticResponseAction\\\":\\\"BLOCK|COUNT\\\"}, \\\"overrideCustomerWebaclClassic\\\":true|false}\"
For example: \"{\\\"type\\\":\\\"SHIELD_ADVANCED\\\",\\\"automaticResponseConfiguration\\\": {\\\"automaticResponseStatus\\\":\\\"ENABLED\\\", \\\"automaticResponseAction\\\":\\\"COUNT\\\"}}\"
The default value for automaticResponseStatus
is IGNORED
. The value for automaticResponseAction
is only required when automaticResponseStatus
is set to ENABLED
. The default value for overrideCustomerWebaclClassic
is false
.
For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData
configuration is an empty string.
Example: WAFV2
- Account takeover prevention and Bot Control managed rule groups, and rule action override
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesATPRuleSet\\\",\\\"managedRuleGroupConfigs\\\":[{\\\"awsmanagedRulesATPRuleSet\\\":{\\\"loginPath\\\":\\\"/loginpath\\\",\\\"requestInspection\\\":{\\\"payloadType\\\":\\\"FORM_ENCODED|JSON\\\",\\\"usernameField\\\":{\\\"identifier\\\":\\\"/form/username\\\"},\\\"passwordField\\\":{\\\"identifier\\\":\\\"/form/password\\\"}}}}]},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[],\\\"sampledRequestsEnabled\\\":true},{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesBotControlRuleSet\\\",\\\"managedRuleGroupConfigs\\\":[{\\\"awsmanagedRulesBotControlRuleSet\\\":{\\\"inspectionLevel\\\":\\\"TARGETED|COMMON\\\"}}]},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[],\\\"sampledRequestsEnabled\\\":true,\\\"ruleActionOverrides\\\":[{\\\"name\\\":\\\"Rule1\\\",\\\"actionToUse\\\":{\\\"allow|block|count|captcha|challenge\\\":{}}},{\\\"name\\\":\\\"Rule2\\\",\\\"actionToUse\\\":{\\\"allow|block|count|captcha|challenge\\\":{}}}]}],\\\"postProcessRuleGroups\\\":[],\\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"customRequestHandling\\\":null,\\\"customResponse\\\":null,\\\"overrideCustomerWebACLAssociation\\\":false,\\\"loggingConfiguration\\\":null,\\\"sampledRequestsEnabledForDefaultActions\\\":true}\"
Fraud Control account takeover prevention (ATP) - For information about the properties available for AWSManagedRulesATPRuleSet
managed rule groups, see AWSManagedRulesATPRuleSet in the WAF API Reference.
Bot Control - For information about AWSManagedRulesBotControlRuleSet
managed rule groups, see AWSManagedRulesBotControlRuleSet in the WAF API Reference.
Rule action overrides - Firewall Manager supports rule action overrides only for managed rule groups. To configure a RuleActionOverrides
add the Name
of the rule to override, and ActionToUse
, which is the new action to use for the rule. For information about using rule action override, see RuleActionOverride in the WAF API Reference.
Example: WAFV2
- CAPTCHA
and Challenge
configs
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesAdminProtectionRuleSet\\\"},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[],\\\"sampledRequestsEnabled\\\":true}],\\\"postProcessRuleGroups\\\":[],\\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"customRequestHandling\\\":null,\\\"customResponse\\\":null,\\\"overrideCustomerWebACLAssociation\\\":false,\\\"loggingConfiguration\\\":null,\\\"sampledRequestsEnabledForDefaultActions\\\":true,\\\"captchaConfig\\\":{\\\"immunityTimeProperty\\\":{\\\"immunityTime\\\":500}},\\\"challengeConfig\\\":{\\\"immunityTimeProperty\\\":{\\\"immunityTime\\\":800}},\\\"tokenDomains\\\":[\\\"google.com\\\",\\\"amazon.com\\\"]}\"
If you update the policy's values for captchaConfig
, challengeConfig
, or tokenDomains
, Firewall Manager will overwrite your local web ACLs to contain the new value(s). However, if you don't update the policy's captchaConfig
, challengeConfig
, or tokenDomains
values, the values in your local web ACLs will remain unchanged. For information about CAPTCHA and Challenge configs, see CaptchaConfig and ChallengeConfig in the WAF API Reference.
Example: WAFV2
- Firewall Manager support for WAF managed rule group versioning
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":true,\\\"version\\\":\\\"Version_2.0\\\",\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesCommonRuleSet\\\"},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[{\\\"name\\\":\\\"NoUserAgent_HEADER\\\"}]}],\\\"postProcessRuleGroups\\\":[],\\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"overrideCustomerWebACLAssociation\\\":false,\\\"loggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[\\\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\\\"],\\\"redactedFields\\\":[{\\\"redactedFieldType\\\":\\\"SingleHeader\\\",\\\"redactedFieldValue\\\":\\\"Cookies\\\"},{\\\"redactedFieldType\\\":\\\"Method\\\"}]}}\"
To use a specific version of a WAF managed rule group in your Firewall Manager policy, you must set versionEnabled
to true
, and set version
to the version you'd like to use. If you don't set versionEnabled
to true
, or if you omit versionEnabled
, then Firewall Manager uses the default version of the WAF managed rule group.
Example: WAFV2
- Logging configurations
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null, \\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\": {\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\", \\\"managedRuleGroupName\\\":\\\"AWSManagedRulesAdminProtectionRuleSet\\\"} ,\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[], \\\"sampledRequestsEnabled\\\":true}],\\\"postProcessRuleGroups\\\":[], \\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"customRequestHandling\\\" :null,\\\"customResponse\\\":null,\\\"overrideCustomerWebACLAssociation\\\" :false,\\\"loggingConfiguration\\\":{\\\"logDestinationConfigs\\\": [\\\"arn:aws:s3:::aws-waf-logs-example-bucket\\\"] ,\\\"redactedFields\\\":[],\\\"loggingFilterConfigs\\\":{\\\"defaultBehavior\\\":\\\"KEEP\\\", \\\"filters\\\":[{\\\"behavior\\\":\\\"KEEP\\\",\\\"requirement\\\":\\\"MEETS_ALL\\\", \\\"conditions\\\":[{\\\"actionCondition\\\":\\\"CAPTCHA\\\"},{\\\"actionCondition\\\": \\\"CHALLENGE\\\"}, {\\\"actionCondition\\\":\\\"EXCLUDED_AS_COUNT\\\"}]}]}},\\\"sampledRequestsEnabledForDefaultActions\\\":true}\"
Firewall Manager supports Amazon Kinesis Data Firehose and Amazon S3 as the logDestinationConfigs
in your loggingConfiguration
. For information about WAF logging configurations, see LoggingConfiguration in the WAF API Reference
In the loggingConfiguration
, you can specify one logDestinationConfigs
. Optionally provide as many as 20 redactedFields
. The RedactedFieldType
must be one of URI
, QUERY_STRING
, HEADER
, or METHOD
.
Example: WAF Classic
\"{\\\"type\\\": \\\"WAF\\\", \\\"ruleGroups\\\": [{\\\"id\\\":\\\"12345678-1bcd-9012-efga-0987654321ab\\\", \\\"overrideAction\\\" : {\\\"type\\\": \\\"COUNT\\\"}}], \\\"defaultAction\\\": {\\\"type\\\": \\\"BLOCK\\\"}}\"
Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL
\"{\\\"type\\\":\\\"DNS_FIREWALL\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-1\\\",\\\"priority\\\":10}],\\\"postProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-2\\\",\\\"priority\\\":9911}]}\"
Valid values for preProcessRuleGroups
are between 1 and 99. Valid values for postProcessRuleGroups
are between 9901 and 10000.
Example: IMPORT_NETWORK_FIREWALL
\"{\\\"type\\\":\\\"IMPORT_NETWORK_FIREWALL\\\",\\\"awsNetworkFirewallConfig\\\":{\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\\/rg1\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:drop\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:pass\\\"],\\\"networkFirewallStatelessCustomActions\\\":[],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\\/ThreatSignaturesEmergingEventsStrictOrder\\\",\\\"priority\\\":8}],\\\"networkFirewallStatefulEngineOptions\\\":{\\\"ruleOrder\\\":\\\"STRICT_ORDER\\\"},\\\"networkFirewallStatefulDefaultActions\\\":[\\\"aws:drop_strict\\\"]}}\"
\"{\\\"type\\\":\\\"DNS_FIREWALL\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-1\\\",\\\"priority\\\":10}],\\\"postProcessRuleGroups\\\":[{\\\"ruleGroupId\\\":\\\"rslvr-frg-2\\\",\\\"priority\\\":9911}]}\"
Valid values for preProcessRuleGroups
are between 1 and 99. Valid values for postProcessRuleGroups
are between 9901 and 10000.
Example: NETWORK_FIREWALL
- Centralized deployment model
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"awsNetworkFirewallConfig\\\":{\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":true}},\\\"firewallDeploymentModel\\\":{\\\"centralizedFirewallDeploymentModel\\\":{\\\"centralizedFirewallOrchestrationConfig\\\":{\\\"inspectionVpcIds\\\":[{\\\"resourceId\\\":\\\"vpc-1234\\\",\\\"accountId\\\":\\\"123456789011\\\"}],\\\"firewallCreationConfig\\\":{\\\"endpointLocation\\\":{\\\"availabilityZoneConfigList\\\":[{\\\"availabilityZoneId\\\":null,\\\"availabilityZoneName\\\":\\\"us-east-1a\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]}]}},\\\"allowedIPV4CidrList\\\":[]}}}}\"
To use the centralized deployment model, you must set PolicyOption to CENTRALIZED
.
Example: NETWORK_FIREWALL
- Distributed deployment model with automatic Availability Zone configuration
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\",\\\"192.168.0.0/28\\\"],\\\"routeManagementAction\\\":\\\"OFF\\\"},\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":true}}\"
With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create the endpoints in. To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: NETWORK_FIREWALL
- Distributed deployment model with automatic Availability Zone configuration and route management
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\",\\\"192.168.0.0/28\\\"],\\\"routeManagementAction\\\":\\\"MONITOR\\\",\\\"routeManagementTargetTypes\\\":[\\\"InternetGateway\\\"]},\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\": \\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":true}}\"
To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: NETWORK_FIREWALL
- Distributed deployment model with custom Availability Zone configuration
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"fragmentcustomactionname\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\", \\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}},{\\\"actionName\\\":\\\"fragmentcustomactionname\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"fragmentmetricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"firewallCreationConfig\\\":{ \\\"endpointLocation\\\":{\\\"availabilityZoneConfigList\\\":[{\\\"availabilityZoneName\\\":\\\"us-east-1a\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]},{\\\"availabilityZoneName\\\":\\\"us-east-1b\\\",\\\"allowedIPV4CidrList\\\":[ \\\"10.0.0.0/28\\\"]}]} },\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":null,\\\"routeManagementAction\\\":\\\"OFF\\\",\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":boolean}}\"
With custom Availability Zone configuration, you define which specific Availability Zones to create endpoints in by configuring firewallCreationConfig
. To configure the Availability Zones in firewallCreationConfig
, specify either the availabilityZoneName
or availabilityZoneId
parameter, not both parameters.
To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: NETWORK_FIREWALL
- Distributed deployment model with custom Availability Zone configuration and route management
\"{\\\"type\\\":\\\"NETWORK_FIREWALL\\\",\\\"networkFirewallStatelessRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\\\",\\\"priority\\\":1}],\\\"networkFirewallStatelessDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"customActionName\\\"],\\\"networkFirewallStatelessFragmentDefaultActions\\\":[\\\"aws:forward_to_sfe\\\",\\\"fragmentcustomactionname\\\"],\\\"networkFirewallStatelessCustomActions\\\":[{\\\"actionName\\\":\\\"customActionName\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"metricdimensionvalue\\\"}]}}},{\\\"actionName\\\":\\\"fragmentcustomactionname\\\",\\\"actionDefinition\\\":{\\\"publishMetricAction\\\":{\\\"dimensions\\\":[{\\\"value\\\":\\\"fragmentmetricdimensionvalue\\\"}]}}}],\\\"networkFirewallStatefulRuleGroupReferences\\\":[{\\\"resourceARN\\\":\\\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\\\"}],\\\"networkFirewallOrchestrationConfig\\\":{\\\"firewallCreationConfig\\\":{\\\"endpointLocation\\\":{\\\"availabilityZoneConfigList\\\":[{\\\"availabilityZoneName\\\":\\\"us-east-1a\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]},{\\\"availabilityZoneName\\\":\\\"us-east-1b\\\",\\\"allowedIPV4CidrList\\\":[\\\"10.0.0.0/28\\\"]}]}},\\\"singleFirewallEndpointPerVPC\\\":false,\\\"allowedIPV4CidrList\\\":null,\\\"routeManagementAction\\\":\\\"MONITOR\\\",\\\"routeManagementTargetTypes\\\":[\\\"InternetGateway\\\"],\\\"routeManagementConfig\\\":{\\\"allowCrossAZTrafficIfNoEndpoint\\\":true}},\\\"networkFirewallLoggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"ALERT\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}},{\\\"logDestinationType\\\":\\\"S3\\\",\\\"logType\\\":\\\"FLOW\\\",\\\"logDestination\\\":{\\\"bucketName\\\":\\\"s3-bucket-name\\\"}}],\\\"overrideExistingConfig\\\":boolean}}\"
To use the distributed deployment model, you must set PolicyOption to NULL
.
Example: SECURITY_GROUPS_COMMON
\"{\\\"type\\\":\\\"SECURITY_GROUPS_COMMON\\\",\\\"revertManualSecurityGroupChanges\\\":false,\\\"exclusiveResourceSecurityGroupManagement\\\":false, \\\"applyToAllEC2InstanceENIs\\\":false,\\\"securityGroups\\\":[{\\\"id\\\":\\\" sg-000e55995d61a06bd\\\"}]}\"
Example: SECURITY_GROUPS_COMMON
- Security group tag distribution
\"\"{\\\"type\\\":\\\"SECURITY_GROUPS_COMMON\\\",\\\"securityGroups\\\":[{\\\"id\\\":\\\"sg-000e55995d61a06bd\\\"}],\\\"revertManualSecurityGroupChanges\\\":true,\\\"exclusiveResourceSecurityGroupManagement\\\":false,\\\"applyToAllEC2InstanceENIs\\\":false,\\\"includeSharedVPC\\\":false,\\\"enableTagDistribution\\\":true}\"\"
Firewall Manager automatically distributes tags from the primary group to the security groups created by this policy. To use security group tag distribution, you must also set revertManualSecurityGroupChanges
to true
, otherwise Firewall Manager won't be able to create the policy. When you enable revertManualSecurityGroupChanges
, Firewall Manager identifies and reports when the security groups created by this policy become non-compliant.
Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica security groups. System tags begin with the aws:
prefix.
Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns
\"{\\\"type\\\":\\\"SECURITY_GROUPS_COMMON\\\",\\\"revertManualSecurityGroupChanges\\\":false,\\\"exclusiveResourceSecurityGroupManagement\\\":false, \\\"applyToAllEC2InstanceENIs\\\":false,\\\"includeSharedVPC\\\":true,\\\"securityGroups\\\":[{\\\"id\\\":\\\" sg-000e55995d61a06bd\\\"}]}\"
Example: SECURITY_GROUPS_CONTENT_AUDIT
\"{\\\"type\\\":\\\"SECURITY_GROUPS_CONTENT_AUDIT\\\",\\\"securityGroups\\\":[{\\\"id\\\":\\\"sg-000e55995d61a06bd\\\"}],\\\"securityGroupAction\\\":{\\\"type\\\":\\\"ALLOW\\\"}}\"
The security group action for content audit can be ALLOW
or DENY
. For ALLOW
, all in-scope security group rules must be within the allowed range of the policy's security group rules. For DENY
, all in-scope security group rules must not contain a value or a range that matches a rule value or range in the policy security group.
Example: SECURITY_GROUPS_USAGE_AUDIT
\"{\\\"type\\\":\\\"SECURITY_GROUPS_USAGE_AUDIT\\\",\\\"deleteUnusedSecurityGroups\\\":true,\\\"coalesceRedundantSecurityGroups\\\":true}\"
Example: SHIELD_ADVANCED
with web ACL management
\"{\\\"type\\\":\\\"SHIELD_ADVANCED\\\",\\\"optimizeUnassociatedWebACL\\\":true}\"
If you set optimizeUnassociatedWebACL
to true
, Firewall Manager creates web ACLs in accounts within the policy scope if the web ACLs will be used by at least one resource. Firewall Manager creates web ACLs in the accounts within policy scope only if the web ACLs will be used by at least one resource. If at any time an account comes into policy scope, Firewall Manager automatically creates a web ACL in the account if at least one resource will use the web ACL.
Upon enablement, Firewall Manager performs a one-time cleanup of unused web ACLs in your account. The cleanup process can take several hours. If a resource leaves policy scope after Firewall Manager creates a web ACL, Firewall Manager doesn't disassociate the resource from the web ACL. If you want Firewall Manager to clean up the web ACL, you must first manually disassociate the resources from the web ACL, and then enable the manage unused web ACLs option in your policy.
If you set optimizeUnassociatedWebACL
to false
, and Firewall Manager automatically creates an empty web ACL in each account that's within policy scope.
Specification for SHIELD_ADVANCED
for Amazon CloudFront distributions
\"{\\\"type\\\":\\\"SHIELD_ADVANCED\\\",\\\"automaticResponseConfiguration\\\": {\\\"automaticResponseStatus\\\":\\\"ENABLED|IGNORED|DISABLED\\\", \\\"automaticResponseAction\\\":\\\"BLOCK|COUNT\\\"}, \\\"overrideCustomerWebaclClassic\\\":true|false, \\\"optimizeUnassociatedWebACL\\\":true|false}\"
For example: \"{\\\"type\\\":\\\"SHIELD_ADVANCED\\\",\\\"automaticResponseConfiguration\\\": {\\\"automaticResponseStatus\\\":\\\"ENABLED\\\", \\\"automaticResponseAction\\\":\\\"COUNT\\\"}}\"
The default value for automaticResponseStatus
is IGNORED
. The value for automaticResponseAction
is only required when automaticResponseStatus
is set to ENABLED
. The default value for overrideCustomerWebaclClassic
is false
.
For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData
configuration is an empty string.
Example: THIRD_PARTY_FIREWALL
Replace THIRD_PARTY_FIREWALL_NAME
with the name of the third-party firewall.
\"{ \"type\":\"THIRD_PARTY_FIREWALL\", \"thirdPartyFirewall\":\"THIRD_PARTY_FIREWALL_NAME\", \"thirdPartyFirewallConfig\":{ \"thirdPartyFirewallPolicyList\":[\"global-1\"] }, \"firewallDeploymentModel\":{ \"distributedFirewallDeploymentModel\":{ \"distributedFirewallOrchestrationConfig\":{ \"firewallCreationConfig\":{ \"endpointLocation\":{ \"availabilityZoneConfigList\":[ { \"availabilityZoneName\":\"${AvailabilityZone}\" } ] } }, \"allowedIPV4CidrList\":[ ] } } } }\"
Example: WAFV2
- Account takeover prevention, Bot Control managed rule groups, optimize unassociated web ACL, and rule action override
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesATPRuleSet\\\",\\\"managedRuleGroupConfigs\\\":[{\\\"awsmanagedRulesATPRuleSet\\\":{\\\"loginPath\\\":\\\"/loginpath\\\",\\\"requestInspection\\\":{\\\"payloadType\\\":\\\"FORM_ENCODED|JSON\\\",\\\"usernameField\\\":{\\\"identifier\\\":\\\"/form/username\\\"},\\\"passwordField\\\":{\\\"identifier\\\":\\\"/form/password\\\"}}}}]},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[],\\\"sampledRequestsEnabled\\\":true},{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesBotControlRuleSet\\\",\\\"managedRuleGroupConfigs\\\":[{\\\"awsmanagedRulesBotControlRuleSet\\\":{\\\"inspectionLevel\\\":\\\"TARGETED|COMMON\\\"}}]},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[],\\\"sampledRequestsEnabled\\\":true,\\\"ruleActionOverrides\\\":[{\\\"name\\\":\\\"Rule1\\\",\\\"actionToUse\\\":{\\\"allow|block|count|captcha|challenge\\\":{}}},{\\\"name\\\":\\\"Rule2\\\",\\\"actionToUse\\\":{\\\"allow|block|count|captcha|challenge\\\":{}}}]}],\\\"postProcessRuleGroups\\\":[],\\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"customRequestHandling\\\":null,\\\"customResponse\\\":null,\\\"overrideCustomerWebACLAssociation\\\":false,\\\"loggingConfiguration\\\":null,\\\"sampledRequestsEnabledForDefaultActions\\\":true,\\\"optimizeUnassociatedWebACL\\\":true}\"
Bot Control - For information about AWSManagedRulesBotControlRuleSet
managed rule groups, see AWSManagedRulesBotControlRuleSet in the WAF API Reference.
Fraud Control account takeover prevention (ATP) - For information about the properties available for AWSManagedRulesATPRuleSet
managed rule groups, see AWSManagedRulesATPRuleSet in the WAF API Reference.
Optimize unassociated web ACL - If you set optimizeUnassociatedWebACL
to true
, Firewall Manager creates web ACLs in accounts within the policy scope if the web ACLs will be used by at least one resource. Firewall Manager creates web ACLs in the accounts within policy scope only if the web ACLs will be used by at least one resource. If at any time an account comes into policy scope, Firewall Manager automatically creates a web ACL in the account if at least one resource will use the web ACL.
Upon enablement, Firewall Manager performs a one-time cleanup of unused web ACLs in your account. The cleanup process can take several hours. If a resource leaves policy scope after Firewall Manager creates a web ACL, Firewall Manager disassociates the resource from the web ACL, but won't clean up the unused web ACL. Firewall Manager only cleans up unused web ACLs when you first enable management of unused web ACLs in a policy.
If you set optimizeUnassociatedWebACL
to false
Firewall Manager doesn't manage unused web ACLs, and Firewall Manager automatically creates an empty web ACL in each account that's within policy scope.
Rule action overrides - Firewall Manager supports rule action overrides only for managed rule groups. To configure a RuleActionOverrides
add the Name
of the rule to override, and ActionToUse
, which is the new action to use for the rule. For information about using rule action override, see RuleActionOverride in the WAF API Reference.
Example: WAFV2
- CAPTCHA
and Challenge
configs
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesAdminProtectionRuleSet\\\"},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[],\\\"sampledRequestsEnabled\\\":true}],\\\"postProcessRuleGroups\\\":[],\\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"customRequestHandling\\\":null,\\\"customResponse\\\":null,\\\"overrideCustomerWebACLAssociation\\\":false,\\\"loggingConfiguration\\\":null,\\\"sampledRequestsEnabledForDefaultActions\\\":true,\\\"captchaConfig\\\":{\\\"immunityTimeProperty\\\":{\\\"immunityTime\\\":500}},\\\"challengeConfig\\\":{\\\"immunityTimeProperty\\\":{\\\"immunityTime\\\":800}},\\\"tokenDomains\\\":[\\\"google.com\\\",\\\"amazon.com\\\"],\\\"associationConfig\\\":{\\\"requestBody\\\":{\\\"CLOUDFRONT\\\":{\\\"defaultSizeInspectionLimit\\\":\\\"KB_16\\\"}}}}\"
CAPTCHA
and Challenge
configs - If you update the policy's values for associationConfig
, captchaConfig
, challengeConfig
, or tokenDomains
, Firewall Manager will overwrite your local web ACLs to contain the new value(s). However, if you don't update the policy's associationConfig
, captchaConfig
, challengeConfig
, or tokenDomains
values, the values in your local web ACLs will remain unchanged. For information about association configs, see AssociationConfig. For information about CAPTCHA and Challenge configs, see CaptchaConfig and ChallengeConfig in the WAF API Reference.
defaultSizeInspectionLimit
- Specifies the maximum size of the web request body component that an associated Amazon CloudFront distribution should send to WAF for inspection. For more information, see DefaultSizeInspectionLimit in the WAF API Reference.
Example: WAFV2
- Firewall Manager support for WAF managed rule group versioning
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null,\\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\":{\\\"versionEnabled\\\":true,\\\"version\\\":\\\"Version_2.0\\\",\\\"vendorName\\\":\\\"AWS\\\",\\\"managedRuleGroupName\\\":\\\"AWSManagedRulesCommonRuleSet\\\"},\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[{\\\"name\\\":\\\"NoUserAgent_HEADER\\\"}]}],\\\"postProcessRuleGroups\\\":[],\\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"overrideCustomerWebACLAssociation\\\":false,\\\"loggingConfiguration\\\":{\\\"logDestinationConfigs\\\":[\\\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\\\"],\\\"redactedFields\\\":[{\\\"redactedFieldType\\\":\\\"SingleHeader\\\",\\\"redactedFieldValue\\\":\\\"Cookies\\\"},{\\\"redactedFieldType\\\":\\\"Method\\\"}]}}\"
To use a specific version of a WAF managed rule group in your Firewall Manager policy, you must set versionEnabled
to true
, and set version
to the version you'd like to use. If you don't set versionEnabled
to true
, or if you omit versionEnabled
, then Firewall Manager uses the default version of the WAF managed rule group.
Example: WAFV2
- Logging configurations
\"{\\\"type\\\":\\\"WAFV2\\\",\\\"preProcessRuleGroups\\\":[{\\\"ruleGroupArn\\\":null, \\\"overrideAction\\\":{\\\"type\\\":\\\"NONE\\\"},\\\"managedRuleGroupIdentifier\\\": {\\\"versionEnabled\\\":null,\\\"version\\\":null,\\\"vendorName\\\":\\\"AWS\\\", \\\"managedRuleGroupName\\\":\\\"AWSManagedRulesAdminProtectionRuleSet\\\"} ,\\\"ruleGroupType\\\":\\\"ManagedRuleGroup\\\",\\\"excludeRules\\\":[], \\\"sampledRequestsEnabled\\\":true}],\\\"postProcessRuleGroups\\\":[], \\\"defaultAction\\\":{\\\"type\\\":\\\"ALLOW\\\"},\\\"customRequestHandling\\\" :null,\\\"customResponse\\\":null,\\\"overrideCustomerWebACLAssociation\\\" :false,\\\"loggingConfiguration\\\":{\\\"logDestinationConfigs\\\": [\\\"arn:aws:s3:::aws-waf-logs-example-bucket\\\"] ,\\\"redactedFields\\\":[],\\\"loggingFilterConfigs\\\":{\\\"defaultBehavior\\\":\\\"KEEP\\\", \\\"filters\\\":[{\\\"behavior\\\":\\\"KEEP\\\",\\\"requirement\\\":\\\"MEETS_ALL\\\", \\\"conditions\\\":[{\\\"actionCondition\\\":\\\"CAPTCHA\\\"},{\\\"actionCondition\\\": \\\"CHALLENGE\\\"}, {\\\"actionCondition\\\":\\\"EXCLUDED_AS_COUNT\\\"}]}]}},\\\"sampledRequestsEnabledForDefaultActions\\\":true}\"
Firewall Manager supports Amazon Kinesis Data Firehose and Amazon S3 as the logDestinationConfigs
in your loggingConfiguration
. For information about WAF logging configurations, see LoggingConfiguration in the WAF API Reference
In the loggingConfiguration
, you can specify one logDestinationConfigs
. Optionally provide as many as 20 redactedFields
. The RedactedFieldType
must be one of URI
, QUERY_STRING
, HEADER
, or METHOD
.
Example: WAF Classic
\"{\\\"type\\\": \\\"WAF\\\", \\\"ruleGroups\\\": [{\\\"id\\\":\\\"12345678-1bcd-9012-efga-0987654321ab\\\", \\\"overrideAction\\\" : {\\\"type\\\": \\\"COUNT\\\"}}], \\\"defaultAction\\\": {\\\"type\\\": \\\"BLOCK\\\"}}\"
Creates a zero-ETL integration with Amazon Redshift. For more information, see Working with Amazon Aurora zero-ETL integrations with Amazon Redshift in the Amazon Aurora User Guide.
" + "documentation": "Creates a zero-ETL integration with Amazon Redshift.
" }, "CreateOptionGroup": { "name": "CreateOptionGroup", @@ -1537,7 +1537,7 @@ "shape": "InvalidIntegrationStateFault" } ], - "documentation": "Deletes a zero-ETL integration with Amazon Redshift. For more information, see Deleting Amazon Aurora zero-ETL integrations with Amazon Redshift in the Amazon Aurora User Guide
" + "documentation": "Deletes a zero-ETL integration with Amazon Redshift.
" }, "DeleteOptionGroup": { "name": "DeleteOptionGroup", @@ -2282,7 +2282,7 @@ "shape": "IntegrationNotFoundFault" } ], - "documentation": "Describe one or more zero-ETL integration with Amazon Redshift. For more information, see Viewing and monitoring Amazon Aurora zero-ETL integrations with Amazon Redshift in the Amazon Aurora User Guide
" + "documentation": "Describe one or more zero-ETL integrations with Amazon Redshift.
" }, "DescribeOptionGroupOptions": { "name": "DescribeOptionGroupOptions", @@ -6501,7 +6501,7 @@ "members": { "SourceArn": { "shape": "SourceArn", - "documentation": "The Amazon Resource Name (ARN) of the Aurora DB cluster to use as the source for replication.
" + "documentation": "The Amazon Resource Name (ARN) of the database to use as the source for replication.
" }, "TargetArn": { "shape": "Arn", @@ -6513,7 +6513,7 @@ }, "KMSKeyId": { "shape": "String", - "documentation": "The Amazon Web Services Key Management System (Amazon Web Services KMS) key identifier for the key to use to encrypt the integration. If you don't specify an encryption key, Aurora uses a default Amazon Web Services owned key.
" + "documentation": "The Amazon Web Services Key Management System (Amazon Web Services KMS) key identifier for the key to use to encrypt the integration. If you don't specify an encryption key, RDS uses a default Amazon Web Services owned key.
" }, "AdditionalEncryptionContext": { "shape": "EncryptionContextMap", @@ -7684,7 +7684,7 @@ }, "SupportsIntegrations": { "shape": "Boolean", - "documentation": "Indicates whether the DB engine version supports Aurora zero-ETL integrations with Amazon Redshift.
" + "documentation": "Indicates whether the DB engine version supports zero-ETL integrations with Amazon Redshift.
" } }, "documentation": "This data type is used as a response element in the action DescribeDBEngineVersions
.
The Amazon Resource Name (ARN) of the Aurora DB cluster used as the source for replication.
" + "documentation": "The Amazon Resource Name (ARN) of the database used as the source for replication.
" }, "TargetArn": { "shape": "Arn", @@ -11589,7 +11589,7 @@ "documentation": "Any errors associated with the integration.
" } }, - "documentation": "An Aurora zero-ETL integration with Amazon Redshift. For more information, see Working with Amazon Aurora zero-ETL integrations with Amazon Redshift in the Amazon Aurora User Guide.
" + "documentation": "A zero-ETL integration with Amazon Redshift.
" }, "IntegrationArn": { "type": "string", @@ -16097,7 +16097,7 @@ }, "SupportsIntegrations": { "shape": "BooleanOptional", - "documentation": "Indicates whether the DB engine version supports Aurora zero-ETL integrations with Amazon Redshift.
" + "documentation": "Indicates whether the DB engine version supports zero-ETL integrations with Amazon Redshift.
" } }, "documentation": "The version of the database engine that a DB instance can be upgraded to.
" diff --git a/clients/controltower.d.ts b/clients/controltower.d.ts index 54d6345be7..6b2b5cd660 100644 --- a/clients/controltower.d.ts +++ b/clients/controltower.d.ts @@ -20,37 +20,61 @@ declare class ControlTower extends Service { */ disableControl(callback?: (err: AWSError, data: ControlTower.Types.DisableControlOutput) => void): Request>1,l=23===i?Math.pow(2,-24)-Math.pow(2,-77):0,d=a?0:s-1,y=a?1:-1,b=t<0||0===t&&1/t<0?1:0;for(t=Math.abs(t),isNaN(t)||t===1/0?(n=isNaN(t)?1:0,o=m):(o=Math.floor(Math.log(t)/Math.LN2),t*(u=Math.pow(2,-o))<1&&(o--,u*=2),t+=o+c>=1?l/u:l*Math.pow(2,1-c),t*u>=2&&(o++,u/=2),o+c>=m?(n=0,o=m):o+c>=1?(n=(t*u-1)*Math.pow(2,i),o+=c):(n=t*Math.pow(2,c-1)*Math.pow(2,i),o=0));i>=8;e[r+d]=255&n,d+=y,n/=256,i-=8);for(o=o<0;e[r+d]=255&o,d+=y,o/=256,p-=8);e[r+d-y]|=128*b}},{}],443:[function(e,t,r){var a={}.toString;t.exports=Array.isArray||function(e){return"[object Array]"==a.call(e)}},{}],444:[function(e,t,r){!function(e){"use strict";function t(e){return null!==e&&"[object Array]"===Object.prototype.toString.call(e)}function r(e){return null!==e&&"[object Object]"===Object.prototype.toString.call(e)}function a(e,i){if(e===i)return!0;if(Object.prototype.toString.call(e)!==Object.prototype.toString.call(i))return!1;if(!0===t(e)){if(e.length!==i.length)return!1;for(var s=0;s =0?this.expression(e):"Lbracket"===t?(this._match("Lbracket"),this._parseMultiselectList()):"Lbrace"===t?(this._match("Lbrace"),this._parseMultiselectHash()):void 0},_parseProjectionRHS:function(e){var t;if(P[this._lookahead(0)]<10)t={type:"Identity"};else if("Lbracket"===this._lookahead(0))t=this.expression(e);else if("Filter"===this._lookahead(0))t=this.expression(e);else{if("Dot"!==this._lookahead(0)){var r=this._lookaheadToken(0),a=new Error("Sytanx error, unexpected token: "+r.value+"("+r.type+")");throw a.name="ParserError",a}this._match("Dot"),t=this._parseDotRHS(e)}return t},_parseMultiselectList:function(){for(var e=[];"Rbracket"!==this._lookahead(0);){var t=this.expression(0);if(e.push(t),"Comma"===this._lookahead(0)&&(this._match("Comma"),"Rbracket"===this._lookahead(0)))throw new Error("Unexpected token Rbracket")}return this._match("Rbracket"),{type:"MultiSelectList",children:e}},_parseMultiselectHash:function(){for(var e,t,r,a,i=[],s=["UnquotedIdentifier","QuotedIdentifier"];;){if(e=this._lookaheadToken(0),s.indexOf(e.type)<0)throw new Error("Expecting an identifier token, got: "+e.type);if(t=e.value,this._advance(),this._match("Colon"),r=this.expression(0),a={type:"KeyValuePair",name:t,value:r},i.push(a),"Comma"===this._lookahead(0))this._match("Comma");else if("Rbrace"===this._lookahead(0)){this._match("Rbrace");break}}return{type:"MultiSelectHash",children:i}}},c.prototype={search:function(e,t){return this.visit(e,t)},visit:function(e,o){var n,u,p,m,c,l,d,y,b;switch(e.type){case"Field":return null!==o&&r(o)?(l=o[e.name],void 0===l?null:l):null;case"Subexpression":for(p=this.visit(e.children[0],o),b=1;b G((f-r)/g)&&i("overflow"),r+=(p-t)*g,t=p,u=0;u =0?(c=b.substr(0,S),l=b.substr(S+1)):(c=b,l=""),d=decodeURIComponent(c),y=decodeURIComponent(l),a(o,d)?i(o[d])?o[d].push(y):o[d]=[o[d],y]:o[d]=y}return o};var i=Array.isArray||function(e){return"[object Array]"===Object.prototype.toString.call(e)}},{}],448:[function(e,t,r){"use strict";function a(e,t){if(e.map)return e.map(t);for(var r=[],a=0;a >1,l=23===i?Math.pow(2,-24)-Math.pow(2,-77):0,d=a?0:s-1,y=a?1:-1,b=t<0||0===t&&1/t<0?1:0;for(t=Math.abs(t),isNaN(t)||t===1/0?(n=isNaN(t)?1:0,o=m):(o=Math.floor(Math.log(t)/Math.LN2),t*(u=Math.pow(2,-o))<1&&(o--,u*=2),t+=o+c>=1?l/u:l*Math.pow(2,1-c),t*u>=2&&(o++,u/=2),o+c>=m?(n=0,o=m):o+c>=1?(n=(t*u-1)*Math.pow(2,i),o+=c):(n=t*Math.pow(2,c-1)*Math.pow(2,i),o=0));i>=8;e[r+d]=255&n,d+=y,n/=256,i-=8);for(o=o<0;e[r+d]=255&o,d+=y,o/=256,p-=8);e[r+d-y]|=128*b}},{}],443:[function(e,t,r){var a={}.toString;t.exports=Array.isArray||function(e){return"[object Array]"==a.call(e)}},{}],444:[function(e,t,r){!function(e){"use strict";function t(e){return null!==e&&"[object Array]"===Object.prototype.toString.call(e)}function r(e){return null!==e&&"[object Object]"===Object.prototype.toString.call(e)}function a(e,i){if(e===i)return!0;if(Object.prototype.toString.call(e)!==Object.prototype.toString.call(i))return!1;if(!0===t(e)){if(e.length!==i.length)return!1;for(var s=0;s =0?this.expression(e):"Lbracket"===t?(this._match("Lbracket"),this._parseMultiselectList()):"Lbrace"===t?(this._match("Lbrace"),this._parseMultiselectHash()):void 0},_parseProjectionRHS:function(e){var t;if(P[this._lookahead(0)]<10)t={type:"Identity"};else if("Lbracket"===this._lookahead(0))t=this.expression(e);else if("Filter"===this._lookahead(0))t=this.expression(e);else{if("Dot"!==this._lookahead(0)){var r=this._lookaheadToken(0),a=new Error("Sytanx error, unexpected token: "+r.value+"("+r.type+")");throw a.name="ParserError",a}this._match("Dot"),t=this._parseDotRHS(e)}return t},_parseMultiselectList:function(){for(var e=[];"Rbracket"!==this._lookahead(0);){var t=this.expression(0);if(e.push(t),"Comma"===this._lookahead(0)&&(this._match("Comma"),"Rbracket"===this._lookahead(0)))throw new Error("Unexpected token Rbracket")}return this._match("Rbracket"),{type:"MultiSelectList",children:e}},_parseMultiselectHash:function(){for(var e,t,r,a,i=[],s=["UnquotedIdentifier","QuotedIdentifier"];;){if(e=this._lookaheadToken(0),s.indexOf(e.type)<0)throw new Error("Expecting an identifier token, got: "+e.type);if(t=e.value,this._advance(),this._match("Colon"),r=this.expression(0),a={type:"KeyValuePair",name:t,value:r},i.push(a),"Comma"===this._lookahead(0))this._match("Comma");else if("Rbrace"===this._lookahead(0)){this._match("Rbrace");break}}return{type:"MultiSelectHash",children:i}}},c.prototype={search:function(e,t){return this.visit(e,t)},visit:function(e,o){var n,u,p,m,c,l,d,y,b;switch(e.type){case"Field":return null!==o&&r(o)?(l=o[e.name],void 0===l?null:l):null;case"Subexpression":for(p=this.visit(e.children[0],o),b=1;b G((f-r)/g)&&i("overflow"),r+=(p-t)*g,t=p,u=0;u =0?(c=b.substr(0,S),l=b.substr(S+1)):(c=b,l=""),d=decodeURIComponent(c),y=decodeURIComponent(l),a(o,d)?i(o[d])?o[d].push(y):o[d]=[o[d],y]:o[d]=y}return o};var i=Array.isArray||function(e){return"[object Array]"===Object.prototype.toString.call(e)}},{}],448:[function(e,t,r){"use strict";function a(e,t){if(e.map)return e.map(t);for(var r=[],a=0;a=55296&&t<=56319&&i65535&&(e-=65536,t+=w(e>>>10&1023|55296),e=56320|1023&e),t+=w(e)}).join("")}function p(e){return e-48<10?e-22:e-65<26?e-65:e-97<26?e-97:T}function m(e,t){return e+22+75*(e<26)-((0!=t)<<5)}function c(e,t,r){var a=0;for(e=r?G(e/R):e>>1,e+=G(e/t);e>L*k>>1;a+=T)e=G(e/L);return G(a+(L+1)*e/(e+A))}function l(e){var t,r,a,s,o,n,m,l,d,y,b=[],S=e.length,g=0,h=v,I=D;for(r=e.lastIndexOf(P),r<0&&(r=0),a=0;a=S&&i("invalid-input"),l=p(e.charCodeAt(s++)),(l>=T||l>G((f-g)/n))&&i("overflow"),g+=l*n,d=m<=I?C:m>=I+k?k:m-I,!(l=t&&bf&&i("overflow"),b==t){for(l=r,d=T;y=d<=o?C:d>=o+k?k:d-o,!(l=0&&delete e.httpRequest.headers["Content-Length"]}function i(e){var t=new l,r=e.service.api.operations[e.operation].input;if(r.payload){var a={},i=r.members[r.payload];a=e.params[r.payload],"structure"===i.type?(e.httpRequest.body=t.build(a||{},i),s(e)):void 0!==a&&(e.httpRequest.body=a,("binary"===i.type||i.isStreaming)&&s(e,!0))}else e.httpRequest.body=t.build(e.params,r),s(e)}function s(e,t){if(!e.httpRequest.headers["Content-Type"]){var r=t?"binary/octet-stream":"application/json";e.httpRequest.headers["Content-Type"]=r}}function o(e){m.buildRequest(e),y.indexOf(e.httpRequest.method)<0&&i(e)}function n(e){c.extractError(e)}function u(e){m.extractData(e);var t,r=e.request,a=r.service.api.operations[r.operation],i=r.service.api.operations[r.operation].output||{};a.hasEventOutput;if(i.payload){var s=i.members[i.payload],o=e.httpResponse.body;if(s.isEventStream)t=new d,e.data[payload]=p.createEventStream(2===AWS.HttpClient.streamsApiVersion?e.httpResponse.stream:o,t,s);else if("structure"===s.type||"list"===s.type){var t=new d;e.data[i.payload]=t.parse(o,s)}else"binary"===s.type||s.isStreaming?e.data[i.payload]=o:e.data[i.payload]=s.toType(o)}else{var n=e.data;c.extractData(e),e.data=p.merge(n,e.data)}}var p=e("../util"),m=e("./rest"),c=e("./json"),l=e("../json/builder"),d=e("../json/parser"),y=["GET","HEAD","DELETE"];t.exports={buildRequest:o,extractError:n,extractData:u,unsetContentLength:a}},{"../json/builder":374,"../json/parser":375,"../util":428,"./json":386,"./rest":388}],390:[function(e,t,r){function a(e){var t=e.service.api.operations[e.operation].input,r=new n.XML.Builder,a=e.params,i=t.payload;if(i){var s=t.members[i];if(void 0===(a=a[i]))return;if("structure"===s.type){var o=s.name;e.httpRequest.body=r.toXML(a,s,o,!0)}else e.httpRequest.body=a}else e.httpRequest.body=r.toXML(a,t,t.name||t.shape||u.string.upperFirst(e.operation)+"Request")}function i(e){p.buildRequest(e),["GET","HEAD"].indexOf(e.httpRequest.method)<0&&a(e)}function s(e){p.extractError(e);var t;try{t=(new n.XML.Parser).parse(e.httpResponse.body.toString())}catch(r){t={Code:e.httpResponse.statusCode,Message:e.httpResponse.statusMessage}}t.Errors&&(t=t.Errors),t.Error&&(t=t.Error),t.Code?e.error=u.error(new Error,{code:t.Code,message:t.Message}):e.error=u.error(new Error,{code:e.httpResponse.statusCode,message:null})}function o(e){p.extractData(e);var t,r=e.request,a=e.httpResponse.body,i=r.service.api.operations[r.operation],s=i.output,o=(i.hasEventOutput,s.payload);if(o){var m=s.members[o];m.isEventStream?(t=new n.XML.Parser,e.data[o]=u.createEventStream(2===n.HttpClient.streamsApiVersion?e.httpResponse.stream:e.httpResponse.body,t,m)):"structure"===m.type?(t=new n.XML.Parser,e.data[o]=t.parse(a.toString(),m)):"binary"===m.type||m.isStreaming?e.data[o]=a:e.data[o]=m.toType(a)}else if(a.length>0){t=new n.XML.Parser;var c=t.parse(a.toString(),s);u.update(e.data,c)}}var n=e("../core"),u=e("../util"),p=e("./rest");t.exports={buildRequest:i,extractError:s,extractData:o}},{"../core":350,"../util":428,"./rest":388}],391:[function(e,t,r){function a(){}function i(e){return e.isQueryName||"ec2"!==e.api.protocol?e.name:e.name[0].toUpperCase()+e.name.substr(1)}function s(e,t,r,a){p.each(r.members,function(r,s){var o=t[r];if(null!==o&&void 0!==o){var n=i(s);n=e?e+"."+n:n,u(n,o,s,a)}})}function o(e,t,r,a){var i=1;p.each(t,function(t,s){var o=r.flattened?".":".entry.",n=o+i+++".",p=n+(r.key.name||"key"),m=n+(r.value.name||"value");u(e+p,t,r.key,a),u(e+m,s,r.value,a)})}function n(e,t,r,a){var s=r.member||{};if(0===t.length)return void a.call(this,e,null);p.arrayEach(t,function(t,o){var n="."+(o+1);if("ec2"===r.api.protocol)n+="";else if(r.flattened){if(s.name){var p=e.split(".");p.pop(),p.push(i(s)),e=p.join(".")}}else n="."+(s.name?s.name:"member")+n;u(e+n,t,s,a)})}function u(e,t,r,a){null!==t&&void 0!==t&&("structure"===r.type?s(e,t,r,a):"list"===r.type?n(e,t,r,a):"map"===r.type?o(e,t,r,a):a(e,r.toWireFormat(t).toString()))}var p=e("../util");a.prototype.serialize=function(e,t,r){s("",e,t,r)},t.exports=a},{"../util":428}],392:[function(e,t,r){var a=e("../core"),i=null,s={signatureVersion:"v4",signingName:"rds-db",operations:{}},o={region:"string",hostname:"string",port:"number",username:"string"};a.RDS.Signer=a.util.inherit({constructor:function(e){this.options=e||{}},convertUrlToAuthToken:function(e){if(0===e.indexOf("https://"))return e.substring("https://".length)},getAuthToken:function(e,t){"function"==typeof e&&void 0===t&&(t=e,e={});var r=this,o="function"==typeof t;e=a.util.merge(this.options,e);var n=this.validateAuthTokenOptions(e);if(!0!==n){if(o)return t(n,null);throw n}var u={region:e.region,endpoint:new a.Endpoint(e.hostname+":"+e.port),paramValidation:!1,signatureVersion:"v4"};e.credentials&&(u.credentials=e.credentials),i=new a.Service(u),i.api=s;var p=i.makeRequest();if(this.modifyRequestForAuthToken(p,e),!o){var m=p.presign(900);return this.convertUrlToAuthToken(m)}p.presign(900,function(e,a){a&&(a=r.convertUrlToAuthToken(a)),t(e,a)})},modifyRequestForAuthToken:function(e,t){e.on("build",e.buildAsGet),e.httpRequest.body=a.util.queryParamsToString({Action:"connect",DBUser:t.username})},validateAuthTokenOptions:function(e){var t="";e=e||{};for(var r in o)Object.prototype.hasOwnProperty.call(o,r)&&typeof e[r]!==o[r]&&(t+="option '"+r+"' should have been type '"+o[r]+"', was '"+typeof e[r]+"'.\n");return!t.length||a.util.error(new Error,{code:"InvalidParameter",message:t})}})},{"../core":350}],393:[function(e,t,r){t.exports={now:function(){return"undefined"!=typeof performance&&"function"==typeof performance.now?performance.now():Date.now()}}},{}],394:[function(e,t,r){function a(e){return"string"==typeof e&&(e.startsWith("fips-")||e.endsWith("-fips"))}function i(e){return"string"==typeof e&&["aws-global","aws-us-gov-global"].includes(e)}function s(e){return["fips-aws-global","aws-fips","aws-global"].includes(e)?"us-east-1":["fips-aws-us-gov-global","aws-us-gov-global"].includes(e)?"us-gov-west-1":e.replace(/fips-(dkr-|prod-)?|-fips/,"")}t.exports={isFipsRegion:a,isGlobalRegion:i,getRealRegion:s}},{}],395:[function(e,t,r){function a(e){if(!e)return null;var t=e.split("-");return t.length<3?null:t.slice(0,t.length-2).join("-")+"-*"}function i(e){var t=e.config.region,r=a(t),i=e.api.endpointPrefix;return[[t,i],[r,i],[t,"*"],[r,"*"],["*",i],[t,"internal-*"],["*","*"]].map(function(e){return e[0]&&e[1]?e.join("/"):null})}function s(e,t){u.each(t,function(t,r){"globalEndpoint"!==t&&(void 0!==e.config[t]&&null!==e.config[t]||(e.config[t]=r))})}function o(e){for(var t=i(e),r=e.config.useFipsEndpoint,a=e.config.useDualstackEndpoint,o=0;o=a())throw new RangeError("Attempt to allocate Buffer larger than maximum size: 0x"+a().toString(16)+" bytes");return 0|e}function b(e){return+e!=e&&(e=0),s.alloc(+e)}function S(e,t){if(s.isBuffer(e))return e.length;if("undefined"!=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(e)||e instanceof ArrayBuffer))return e.byteLength;"string"!=typeof e&&(e=""+e);var r=e.length;if(0===r)return 0;for(var a=!1;;)switch(t){case"ascii":case"latin1":case"binary":return r;case"utf8":case"utf-8":case void 0:return K(e).length;case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return 2*r;case"hex":return r>>>1;case"base64":return H(e).length;default:if(a)return K(e).length;t=(""+t).toLowerCase(),a=!0}}function g(e,t,r){var a=!1;if((void 0===t||t<0)&&(t=0),t>this.length)return"";if((void 0===r||r>this.length)&&(r=this.length),r<=0)return"";if(r>>>=0,t>>>=0,r<=t)return"";for(e||(e="utf8");;)switch(e){case"hex":return E(this,t,r);case"utf8":case"utf-8":return v(this,t,r);case"ascii":return x(this,t,r);case"latin1":case"binary":return q(this,t,r);case"base64":return D(this,t,r);case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return M(this,t,r);default:if(a)throw new TypeError("Unknown encoding: "+e);e=(e+"").toLowerCase(),a=!0}}function h(e,t,r){var a=e[t];e[t]=e[r],e[r]=a}function I(e,t,r,a,i){if(0===e.length)return-1;if("string"==typeof r?(a=r,r=0):r>2147483647?r=2147483647:r<-2147483648&&(r=-2147483648),r=+r,isNaN(r)&&(r=i?0:e.length-1),r<0&&(r=e.length+r),r>=e.length){if(i)return-1;r=e.length-1}else if(r<0){if(!i)return-1;r=0}if("string"==typeof t&&(t=s.from(t,a)),s.isBuffer(t))return 0===t.length?-1:N(e,t,r,a,i);if("number"==typeof t)return t&=255,s.TYPED_ARRAY_SUPPORT&&"function"==typeof Uint8Array.prototype.indexOf?i?Uint8Array.prototype.indexOf.call(e,t,r):Uint8Array.prototype.lastIndexOf.call(e,t,r):N(e,[t],r,a,i);throw new TypeError("val must be string, number or Buffer")}function N(e,t,r,a,i){function s(e,t){return 1===o?e[t]:e.readUInt16BE(t*o)}var o=1,n=e.length,u=t.length;if(void 0!==a&&("ucs2"===(a=String(a).toLowerCase())||"ucs-2"===a||"utf16le"===a||"utf-16le"===a)){if(e.length<2||t.length<2)return-1;o=2,n/=2,u/=2,r/=2}var p;if(i){var m=-1;for(p=r;p>>8*(a?i:1-i)}function B(e,t,r,a){t<0&&(t=4294967295+t+1);for(var i=0,s=Math.min(e.length-r,4);i>>8*(a?i:3-i)&255}function U(e,t,r,a,i,s){if(r+a>e.length)throw new RangeError("Index out of range");if(r<0)throw new RangeError("Index out of range")}function _(e,t,r,a,i){return i||U(e,t,r,4,3.4028234663852886e38,-3.4028234663852886e38),X.write(e,t,r,a,23,4),r+4}function F(e,t,r,a,i){return i||U(e,t,r,8,1.7976931348623157e308,-1.7976931348623157e308),X.write(e,t,r,a,52,8),r+8}function O(e){if(e=V(e).replace(ee,""),e.length<2)return"";for(;e.length%4!=0;)e+="=";return e}function V(e){return e.trim?e.trim():e.replace(/^\s+|\s+$/g,"")}function z(e){return e<16?"0"+e.toString(16):e.toString(16)}function K(e,t){t=t||1/0;for(var r,a=e.length,i=null,s=[],o=0;o55295&&r<57344){if(!i){if(r>56319){(t-=3)>-1&&s.push(239,191,189);continue}if(o+1===a){(t-=3)>-1&&s.push(239,191,189);continue}i=r;continue}if(r<56320){(t-=3)>-1&&s.push(239,191,189),i=r;continue}r=65536+(i-55296<<10|r-56320)}else i&&(t-=3)>-1&&s.push(239,191,189);if(i=null,r<128){if((t-=1)<0)break;s.push(r)}else if(r<2048){if((t-=2)<0)break;s.push(r>>6|192,63&r|128)}else if(r<65536){if((t-=3)<0)break;s.push(r>>12|224,r>>6&63|128,63&r|128)}else{if(!(r<1114112))throw new Error("Invalid code point");if((t-=4)<0)break;s.push(r>>18|240,r>>12&63|128,r>>6&63|128,63&r|128)}}return s}function j(e){for(var t=[],r=0;r=55296&&t<=56319&&i65535&&(e-=65536,t+=w(e>>>10&1023|55296),e=56320|1023&e),t+=w(e)}).join("")}function p(e){return e-48<10?e-22:e-65<26?e-65:e-97<26?e-97:T}function m(e,t){return e+22+75*(e<26)-((0!=t)<<5)}function c(e,t,r){var a=0;for(e=r?G(e/R):e>>1,e+=G(e/t);e>L*k>>1;a+=T)e=G(e/L);return G(a+(L+1)*e/(e+A))}function l(e){var t,r,a,s,o,n,m,l,d,y,b=[],S=e.length,g=0,h=v,I=D;for(r=e.lastIndexOf(P),r<0&&(r=0),a=0;a=S&&i("invalid-input"),l=p(e.charCodeAt(s++)),(l>=T||l>G((f-g)/n))&&i("overflow"),g+=l*n,d=m<=I?C:m>=I+k?k:m-I,!(l=t&&bf&&i("overflow"),b==t){for(l=r,d=T;y=d<=o?C:d>=o+k?k:d-o,!(l